Requesting an expedited build of v0.63.5

[sparkwise]

Until then, the recommended temporary workaround is for users to block the affected endpoint (/api/session/reset_password).

[luckow]

mh. this release isn’t available https://github.com/metabase/metabase/releases

please add a link to your source.

[sparkwise]

@luckow I emailed Metabase to ask about the missing release.

Notification email came from company CEO sent out earlier this morning. I tried to upload a PDF of the email but can't upload PDF to this forum.

[sparkwise]

@luckow Found it here: https://hub.docker.com/r/metabase/metabase/tags?name=v0.63.5

[joseph]

I guess the question is how did you know it has a security issue (or how did your CEO know?) https://www.metabase.com/changelog/63 has no info on this release either .

[sparkwise]

@joseph The CEO of Metabase (not my company’s CEO) sent an email out to their email list. I sent a response to help@metabase.com and they replied immediately to confirm. I’d recommend reaching out to them to confirm. I’ll forward the full email to the Cloudron email account.

[joseph]

Ha ha ok, I misunderstood @james it seems https://downloads.metabase.com/v0.63.5/metabase.jar is available , so we may have to create a manual MR .

[milian.hackradt]

Here's the security advisories for anyone interested:
https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp
https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59

Interestingly, the GitHub Advisory Database includes links to the patched versions while GitHub Releases do not even show these (as of today). There must be a lot of chaos going on behind the scenes since their cloud offering was also breached and has affected fairly big customers (e.g. Framework): https://community.frame.work/t/framework-data-breach-discussion/83939

This app is a great candidate for the VPN Protection coming with Cloudron 10

[luckow]

https://forum.cloudron.io/post/127858 shows that there is an update to the latest version 0.63.5. However, my instance isn't showing any available update. Is there something wrong with the workflow?

[girish]

@luckow there was a typo in the manifest. Can you check again?

[sparkwise]

In case this is useful, I saw the Cloudron app update as being available yesterday and successfully updated. “About Metabase” (in app) reports 0.63.5 but the Cloudron Info tab still says “Metabase 0.63.2.7”.

[girish]

@sparkwise right exactly, the build was correct, but I forgot the update the manifest with the upstreamVersion .

[sparkwise]

Same drill as before, but with a new minimum target release...

The downloads below include the minimum safe release for each Metabase version.
 
63
0.63.10
Docker image: metabase/metabase:v0.63.10
Download the JAR here: https://downloads.metabase.com/v0.63.10/metabase.jar

There is not yet a web link documenting this, so I'd recommend reaching out to help@metabase.com if you want independent first-party confirmation on this.

[james]

Hello @sparkwise
Please stop creating a new topic each time.
I will merge the topics into each other.

[sparkwise]

@james Understood. For situations like these, is posting on this public forum still preferred over email to support@ or security@?