22 lines
1.9 KiB
Markdown
22 lines
1.9 KiB
Markdown
# immich — triage (pins immich-server:v3.2.4, immich-machine-learning:v3.2.4)
|
|
Template: setup_gate: true.
|
|
|
|
## Notices
|
|
- GHSA-8244-8vpr-vp9c (CVE-2026-53662, critical, login-page `continue` XSS) — NOT-A-FINDING.
|
|
Range is git-commit form (`> main@4ffa26c9`, patched `> main@4eb1003`); advisory text: "No tagged release is affected", bug only on `main`
|
|
builds since 2026-04-15. Checked by hand via GitHub compare API: v3.2.4...4eb1003 = "behind" (fix commit 4eb100327e, "fix: disallow cross
|
|
origin/non http protocols for continueUrl on login (#28706)", 2026-06-01) is an ANCESTOR of v3.2.4. Fix shipped before v3.0.0 (2026-07-02).
|
|
- release:v3.3.5 — REAL runtime fix (no GHSA): Node.js Oct-2026 security release + certifi CA bundle / python image digests after the eMudhra
|
|
CA compromise. Upstream: "we don't believe this ... brings an immediate danger". Severity: unsure (runtime; Node Brotli RCE CVE-2026-111497
|
|
is in that Node release, exploit path in Immich not described). Login: n/a. Reachable: n/a (TLS trust + Node runtime).
|
|
|
|
## Fix
|
|
No real GHSA. Optional runtime refresh: TARGET `ghcr.io/immich-app/immich-server:v3.3.5` AND `ghcr.io/immich-app/immich-machine-learning:v3.3.5`
|
|
(both tags verified on ghcr; must move together).
|
|
postgres (`ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0`) and `redis:7-alpine`: do NOT need to move — upstream
|
|
docker/docker-compose.yml at v3.2.4 and v3.3.5 pins the identical postgres image (14-vectorchord0.4.3-pgvectors0.2.0, same digest) and valkey:9 in both.
|
|
Same main (3): yes. Breaking: none found in 5 stable releases (v3.3.0, 3.3.1, 3.3.3, 3.3.4, 3.3.5) + 3 RCs; v3.3.0 ML model revision v2 is opt-in
|
|
(`MACHINE_LEARNING_MODEL_REVISION=v2`), migrations self-run.
|
|
Lane: NOT_A_FINDING for the GHSA; SECURITY_FIX (runtime) v3.3.5 if the operator wants the Node/CA refresh.
|
|
Classifier note: GHSA ranges of form `main@<sha>` mean "untagged main builds" — treat as not affecting tagged pins unless the text says otherwise.
|