v8.1.6
Security 6
- Fix SQL injection coming from actor inbox URL when updating actor follow scores
- Reject JSON-LD objects with special properties
- Restrict role assignment to administrators only
- Prevent external auth token replay
- Prevent SSRF on import and channel sync
- Apply stricter rate limit to ask password reset
IMPORTANT NOTES
- Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2
SECURITY
- Fix SQL injection coming from actor inbox URL when updating actor follow scores. Thanks to Nagarajan Selvaraj Paulmony for reporting this vulnerability :pray: https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x
- Reject JSON-LD objects with special properties. Thanks to Mastodon security team for reporting this vulnerability :pray:
- Restricts role assignment to administrators only
- Prevent external auth token replay
- Prevent SSRF on import and channel sync
- Stricter rate limit to ask password reset