11–20 of 76 posts
Earlier quoted context omitted.
They say they’ll be releasing the patch publicly, but isn’t this OSS, can’t anyone just do a diff and with a little “elbow grease” find the patch?
https://github.com/metabase/metabase/compare/v0.46.6...v0.46... I can't tell if that's it? edit: I've looked at it a few times, I don't think that's it?
Earlier quoted context omitted.
https://github.com/metabase/metabase/compare/v0.46.6...v0.46... I can't tell if that's it? edit: I've looked at it a few times, I don't think that's it?
The only thing that seems remotely interesting is the "private key" part - I don't know Clojure but it doesn't seem like that's it.
aka, It isn't checked in to source control publicly yet. Interesting.
I tried to "decompile" the jars and loop over the files but it didn't yield much/wasn't clean enough to be of help.
It would be nice to know if this vulnerability affects people who never made their Metabase installations publicly accessible. Aka if I am running Metabase locally.
For more context: https://www.metabase.com/blog/security-advisory
They say they’ll be releasing the patch publicly, but isn’t this OSS, can’t anyone just do a diff and with a little “elbow grease” find the patch?
The old version has `hash=1bb88f5`, which is a public commit: https://github.com/metabase/metabase/commit/1bb88f5
Whereas the new version has `hash=c8912af`, which is not: https://github.com/metabase/metabase/commit/c8912af
For more context: https://www.metabase.com/blog/security-advisory
They say they’ll be releasing the patch publicly, but isn’t this OSS, can’t anyone just do a diff and with a little “elbow grease” find the patch?
This is why I try to put everything behind NGINX with basic auth. Unfortunately not everything works well that way but in this case I suspect that this is made unexploitable by anyone without the password.
Ha, I was just about to go in here and say the same thing. "Fortunately" some "white hat" hacker contacted us last year about another Metabase exploit. I gave him a 30 USD tip and ended up doing exactly what you are suggesting. Now I'm glad that means I don't need to interrupt my vacation to fix this thing right now.
Earlier quoted context omitted.
They say they’ll be releasing the patch publicly, but isn’t this OSS, can’t anyone just do a diff and with a little “elbow grease” find the patch?
They haven't released the source, and the compiled versions are non-trivial to diff (e.g. there are nondeterministic numbers from the clojure compiler that seem to have changed from one to the other, and .clj files have been removed from the jar). The old version has `hash=1bb88f5`, which is a public commit: https://github.com/metabase/metabase/commit/1bb88f5 Whereas the new version has `hash=c8912af`, which is not:…
Earlier quoted context omitted.
They haven't released the source, and the compiled versions are non-trivial to diff (e.g. there are nondeterministic numbers from the clojure compiler that seem to have changed from one to the other, and .clj files have been removed from the jar). The old version has `hash=1bb88f5`, which is a public commit: https://github.com/metabase/metabase/commit/1bb88f5 Whereas the new version has `hash=c8912af`, which is not:…
I didn't even know you could have a "private" commit on GitHub/an open source repo like that.