le_throosh6d ago

CVE: Possible Organization/Secret Compromise from dangerous CI implementation

https://lemmy.dbzer0.com/post/65996465

CVE: Possible Organization/Secret Compromise from dangerous CI implementation - Divisions by zero

Strange that there was no comms whatsover from the team about this

Show threadrenegadespork
Everyone might want to freeze your Jellyfin versions until this gets sorted. As far as we know, nothing has been hijacked, but safer sit on your local copies for now.
Mar 25 at 10:47pmWeb
Show threadLink6d ago

Hasn’t it already been patched? https://github.com/jellyfin/jellyfin-ios/security/advisories/GHSA-7qhm-2m45-7fmh

Patches

CI workflows have been modified in all affected repositories, and secrets have been rotated.

Show threadslacktoid6d ago
This doesn’t affect the code or jellyfin. Its a problem with how github does CI that needs to be fixed.
Show threadrenegadespork6d ago
I know. My comment stands. Though apparently it was already patched.
Show threadnoodle6d ago

@renegadespork @le_throosh
"Note: This is not a code vulnerability, but a vulnerability in the GitHub Actions workflows. No new version is required for this GHSA and end users do not need to take any actions."

Edit: This is just for context to save others looking up the CVE. 'wait and see' makes sense, particularly when a major update is potentially in the near future.

Show threadrenegadespork6d ago
I know. My comment stands. Though apparently it was already patched.
Show threadle_throosh5d ago
I think its our local copies that might have issues if anything. If there is a threat at all, it would affect releases prior to the cve release not since then. Or yeah, if a possible attacker had gained access they may still have it, but its unlikely that would not have been caught.