Pleroma Security Release: 2.11.1
Pleroma 2.11.1 is a security release. It updates two dependencies:
- Bandit, the web server, to 1.14.0. Clients could use up memory and CPU with HTTP/1.1, HTTP/2 and WebSocket requests, and bare CR or LF in chunk extensions allowed request smuggling.
- Hackney, an HTTP client, to 4.9.1. Hackney buffered and decompressed response bodies without a limit, did not restrict trust to a custom CA bundle, sent credentials again after a redirect to a different scheme or port, and had an SSRF allowlist bypass and a CRLF injection in proxy authentication.
Gun is the default HTTP client since 2.11.0, so the Hackney issues only affect instances that changed the Tesla adapter back to Hackney, and mail sent through the Swoosh HTTP adapters. The Bandit issues affect every instance.
Update immediately.
The advisories are on the EEF CNA list.
Upgrade notes
From source only
Get new dependencies and recompile Pleroma:
MIX_ENV=prod mix deps.get MIX_ENV=prod mix compile
Everyone
- Restart Pleroma
This release has no new migrations.