release_candidate_1.0rc3.1Desktop
OpenRGB Release Candidate 1.0rc3 Hotfix 1
Security 4
- Add filename sanitization to profile save, load, and delete requests
- Add limit to the maximum packet size accepted by the server and client
- Run the background service to localhost only
- Add hardening to the included systemd service file
From OpenRGB
This is a small hotfix release for OpenRGB Release Candidate 1.0rc3 that addresses some security issues. It adds filename sanitization to profile save, load, and delete requests, a limit to the maximum packet size accepted by the server and client, and runs the background service to localhost only. It also adds some hardening to the included systemd service file.
This addresses a situation where a malicious client could escape the OpenRGB configuration directory when performing a profile save or delete operation.