3 ms·
The issue was fixed entirely on the root side. No release was necessary. It was a private disclosure and we fixed it within a few hours. No release is technica
by api 5y ago
The issue was fixed entirely on the root side. No release was necessary. It was a private disclosure and we fixed it within a few hours.
No release is technically required now, but we have one coming that contains an endpoint-side mitigation that renders the attack and others like it impossible even if the root is misbehaving. A 1.6.6 patch release is currently being built as we speak and it will also be in 1.8, which is delayed to fix some issues with the new UI.
- testplzignore 5y agoWhy are there further mitigations being put in now, rather than this all being in place before the public disclosure?
- api 5y agoThe root fix renders this exact attack impossible with current nodes, but we think it's a good idea to close the gap in another way that renders this entire class of attacks impossible just in case someone figures out some other way to accomplish something similar. We found a way to do that so we are releasing it. I don't think security should be done by just playing whack a mole. You want to try to get ahead of it. If there's an opportunity to harden something, do it.