diff options
| author | Henri Vasserman <henv@hot.ee> | 2025-04-01 01:42:12 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-03-31 18:42:12 -0400 |
| commit | b4a2e1a6a0014446252645db6e61c596e16fbcd4 (patch) | |
| tree | 684cda635dcd4d8e3d21e0f5b727f6e50d9280cb /docs | |
| parent | 28828a2e93de32e758b62107f0af0a429b911b90 (diff) | |
| download | anubis-b4a2e1a6a0014446252645db6e61c596e16fbcd4.tar.xz anubis-b4a2e1a6a0014446252645db6e61c596e16fbcd4.zip | |
lib/anubis: actually check the result with the correct difficulty (#180)
* cmd/anubis actually check the result with the correct difficulty
* chore: changelog
* test(cmd/anubis): make test check for difficulty
* lib: add regression test for CVE-2025-24369
Signed-off-by: Xe Iaso <me@xeiaso.net>
* bump VERSION and CHANGELOG
Tracks #181
Signed-off-by: Xe Iaso <me@xeiaso.net>
---------
Signed-off-by: Xe Iaso <me@xeiaso.net>
Co-authored-by: Xe Iaso <me@xeiaso.net>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/docs/CHANGELOG.md | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index 931ab9d..18513f5 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -10,6 +10,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] + - Added a periodic cleanup routine for the decaymap that removes expired entries, ensuring stale data is properly pruned. - Added a no-store Cache-Control header to the challenge page - Hide the directory listings for Anubis' internal static content @@ -28,6 +29,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed a typo in the challenge page title. - Disabled running integration tests on Windows hosts due to it's reliance on posix features (see [#133](https://github.com/TecharoHQ/anubis/pull/133#issuecomment-2764732309)). +## v1.15.1 + +Zenos yae Galvus: Echo 1 + +Fixes a recurrence of [CVE-2025-24369](https://github.com/Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f) +due to an incorrect logic change in a refactor. This allows an attacker to mint a valid +access token by passing any SHA-256 hash instead of one that matches the proof-of-work +test. + +This case has been added as a regression test. It was not when CVE-2025-24369 was released +due to the project not having the maturity required to enable this kind of regression testing. + ## v1.15.0 Zenos yae Galvus |