IntenseWebs/pgadmin4
3
0
Fork 0
mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2026-08-17 16:34:44 -05:00
Code Issues Packages Projects Releases Wiki Activity

docs: add release-notes line for #9904 lockout-bypass fix

Browse Source 
Mirrors the CVE-pending entries for #9898-#9902 with reporter credit.
The detailed CVE record (CVSS, description, affected files) is held in
the local docs/CVEs/ working draft and submitted to MITRE/Vulnogram
externally; only the release-notes summary lands in git pre-disclosure.
This commit is contained in:
Ashesh Vashi
2026-05-05 15:03:00 +05:30
parent d336c1e786
commit 32d194691e
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/en_US/release_notes_9_15.rst
+1
View File
@@ -46,6 +46,7 @@ Bug fixes
| `Issue #9900 <https://github.com/pgadmin-org/pgadmin4/issues/9900>`_ - Fix local-file inclusion and server-side request forgery in LLM API configuration endpoints (CVE pending). Reported by j3seer.
| `Issue #9901 <https://github.com/pgadmin-org/pgadmin4/issues/9901>`_ - Fix unsafe deserialization in the session manager that could lead to remote code execution (CVE pending). Also encrypts session files at rest using Fernet, restricts session-file permissions to 0o600, switches the session-digest default from SHA-1 to SHA-256, drops several non-roundtrippable live objects from the session (``AuthSourceManager`` and the Azure, RDS, Google Cloud, and BigAnimal cloud-provider instances), tightens DATA_DIR file and directory permissions at creation, creates ``pgadmin4.log`` with mode 0o600, hardens ``EnhancedRotatingFileHandler._open`` against rotation failures, and bounds the ``user_info_server`` prompt retry loop so a non-interactive caller cannot spin forever. Reported by Fernando Bortotti.
| `Issue #9902 <https://github.com/pgadmin-org/pgadmin4/issues/9902>`_ - Fix symlink-based path traversal in the file manager (CVE pending). Reported by Fernando Bortotti.
| `Issue #9904 <https://github.com/pgadmin-org/pgadmin4/issues/9904>`_ - Fix account-lockout bypass on Flask-Security's default ``/login`` view by overriding ``User.is_active`` and ``User.is_locked()`` so the ``locked`` field is honored on every authentication path (CVE pending). Reported by Fernando Bortotti.
Additional changes (no associated issue)
****************************************