Release Notes

What's Changed

Security Fixes

This release fixes a critical vulnerability. All administrators should upgrade immediately.

• Fixed: arbitrary file read/write through image uploads (Critical).
  Greenlight processes uploaded avatars and presentations with ImageMagick. Through GHSA-f3w6-w445-fwh9 in Rails' Active Storage, a user who can upload a file could read or write files on the server. This release upgrades to Rails 8.0.5.2, which applies a restrictive ImageMagick security policy to all image processing

Action required after upgrading

If your instance stores uploads on local disk (the default, i.e. you have not configured S3 or Google Cloud Storage), assume that secrets readable by the application may have been exposed, and rotate them:

• SECRET_KEY_BASE. Changing it signs every user out.
• Database password (DATABASE_URL)
• BIGBLUEBUTTON_SECRET
• SMTP, OpenID Connect, S3/GCS and any other credentials in your environment