OpenRGB release_candidate_1.0rc3.1

release_candidate_1.0rc3.1Desktop

OpenRGB Release Candidate 1.0rc3 Hotfix 1

Security 4
  • Add filename sanitization to profile save, load, and delete requests
  • Add limit to the maximum packet size accepted by the server and client
  • Run the background service to localhost only
  • Add hardening to the included systemd service file

From OpenRGB

This is a small hotfix release for OpenRGB Release Candidate 1.0rc3 that addresses some security issues. It adds filename sanitization to profile save, load, and delete requests, a limit to the maximum packet size accepted by the server and client, and runs the background service to localhost only. It also adds some hardening to the included systemd service file.

This addresses a situation where a malicious client could escape the OpenRGB configuration directory when performing a profile save or delete operation.

View original

Upgraded? How did it go?

Discussion