Skip to content

1.0.125

Choose a tag to compare

View all tags
@nictuku nictuku released this 22 Sep 20:42
· 3 commits to main since this release
1.0.125
d136b4c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security: fixes GHSA-cx77-j6h8-3382 — the SSRF guard on server-side image fetches classified addresses with a category denylist, so 100.64.0.0/10 (RFC 6598 shared address space) passed it: that range is is_global == False but neither private nor reserved. Kubernetes pod/service CIDRs, cloud internal endpoints and ISP CGNAT live there. Upgrade recommended for self-hosted deployments whose internal services sit in that range.

What's changed

  • fix(security): the guard now tests positively for ip.is_global and rejects everything else, with the original category checks kept alongside it and an explicit list of non-public networks (100.64.0.0/10, 192.0.0.0/24, 198.18.0.0/15, the RFC 5737 TEST-NETs, 240.0.0.0/4, 2001:db8::/32, 64:ff9b:1::/48), since is_global's backing table has shifted across CPython patch releases (#165).
  • IPv4-mapped IPv6 addresses are still unwrapped first, so ::ffff:100.64.1.1 is rejected too, and the redirect re-validation hook blocks hops into the range.

Full changelog: 1.0.124...1.0.125

Assets 2
Loading