IntenseWebs/PeerTube
3
0
Fork 0
mirror of https://github.com/Chocobozzz/PeerTube.git synced 2026-09-03 20:53:09 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update changelog

Browse Source
This commit is contained in:
Chocobozzz
2026-08-04 08:13:30 +02:00
parent 051bdd4cec
commit c2bd457557
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+20 -2
View File
@@ -1,5 +1,13 @@
# Changelog
## v8.2.4
### SECURITY
This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.3**.
In a few days, this changelog will be updated to disclose the vulnerabilities.
## v8.2.3
### SECURITY
@@ -49,8 +57,18 @@ We strongly recommend all administrators upgrade immediately.
### SECURITY
This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.1**. Security hardening is also included.
In a few weeks, this changelog will be updated to disclose the vulnerabilities.
This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.2**. Security hardening is also included.
* **critical** Ensure actor that signs the activity and the video are on the same host when receiving an `Update` activity [GHSA-g9p4-f7h8-hc86](https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86)
* **high** Check HLS filename when proxifying HLS files from object storage [GHSA-93rr-g3x2-ffv4](https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-93rr-g3x2-ffv4)
* **medium** Ensure element belongs to the playlist on update/remove
* **medium** Do not leak video UUID on invalid video view
* **medium** Ensure user has rights to see private live specific metadata
* **hardening** Ensure ZIP entry filename is valid when extracting a ZIP export
* **hardening** Escape admin configuration when injecting it in HTML
* **hardening** Ensure version from plugin index is valid before injecting it in the CLI
* **hardening** Check caption VTT validity when adding a caption to a video
* **hardening** Invalidate all user tokens on password reset or password change
### Bug fixes