Release v1.5.5

Version 1.5.5 is a security release to fix an issue with API authentication.

• Fixed a timing attack security issue in the backend API endpoints to verify a submission, request statistics, and manage rule packages. Found and reported by senti-man via the security advisories (GHSA-9w98-5239-39c2).
• Fixed the wrong command name for the refresh rule package cron jobs. Reported by ffPjrZUGXfcxuAj in #435

Thank you, senti-man, for finding and reporting this issue to us in private via the security advisories.

We recommend updating to v1.5.5 as soon as you can.

Details of the security issue

Description of the security issue

The API endpoints use hashes to validate requests and grant access to the backend. We’ve wrongfully used a simple string comparison, which means that you could guess the private API key by measuring the time.

Risk assessment

The risk of this security issue is manageable. To exploit this issue, an attacker needs to make many requests (thousands) and needs favorable network conditions to guess the correct private key.

Even if the attacker found the private key, the only bad things the attacker could do are adding metadata to a submission and manipulating rule packages, if there are any, in a mosparo project.

It is not possible to request any form or user data. If an attacker successfully obtained the private key, they could only obtain metadata for a submission, project statistics, and the contents of a rule package.

Changes to mitigate the security issue

As suggested by senti-man, we’ve switched the hash comparison to the hash_equals method, which PHP provides specifically for this kind of attack.

Release v1.5.4

Release v1.5.4 fixes a bug with the update process and adjusts the logging configuration.

• Ensure that the project is not loaded after the update. If the update changes the table structure, the project table might not be compatible with the source files, leading to errors during the update process. Reported by OvalMedia and Moskito89 in #432
• Added the required configuration to ignore the deprecation messages in the production environment from the log files and the console output. Reported by ffPjrZUGXfcxuAj in #435

Thank you very much for your help in fixing these issues!

Release v1.5.3

Version 1.5.3 is a bugfix release that fixes a bug and updates the translations.

• Fixed a typo in a query when deleting a project. ffPjrZUGXfcxuAj reported this in #430
• Updated the translations for Bulgarian, Catalan, and Spanish thanks to our contributors.

We’re thankful for all the contributions made by our contributors.

Release v1.5.2

This bugfix release fixes a critical issue with PostgreSQL databases.

• Removed the unnecessary orderBy call from the statistics query since the call is not required and breaks mosparo when a PostgreSQL database is used. Reported by lporcheron in #427

Release v1.5.1

Version 1.5.1 is a bugfix release for the new main version 1.5.0 released yesterday. It fixes an issue with the browser cache and a minor visual issue in the project list.

• Changed one of the API parameters for the request-submit-token endpoint to optional. This will fix issues where the frontend JavaScript file is cached in the browser and a submit token request fails due to a missing parameter. Additionally, the field may be left blank for a valid purpose, so it should not be required in the first place. Reported by BDphilBen in #426
• Fixed a minor visual issue with the info message in the empty project list