18 lines
1.2 KiB
Markdown
18 lines
1.2 KiB
Markdown
# privatebin — triage (pin privatebin/pdo:2.0.6)
|
|
|
|
Template: no gate field; PrivateBin has no login — anyone with the URL can create and read pastes (by design). No custom cfg/conf.php mounted (only /srv/data).
|
|
|
|
## Notices (1 GHSA + 1 release hit)
|
|
- GHSA-w873-3ghv-hmh6 (medium, <= 2.0.6, patched 2.1.0): REAL — Markdown HTML keeps `class` attributes, so a paste can draw a fake
|
|
Bootstrap modal (phishing). Login: none. Reachable: yes (public subdomain, anyone can create a Markdown paste and send the link).
|
|
- release:2.1.0: REAL — the release carrying that fix plus MIME-sniff header fix and comment-file handling fixes.
|
|
Real 2 / 2.
|
|
|
|
## Fix
|
|
Smallest 2.1.0; TARGET `privatebin/pdo:2.1.0` (newest stable; Hub tags 2.1.0 / stable / latest). Same main (2): yes.
|
|
Breaking (read 2.1.0; 2.0.6 baseline): "This release removes the bootstrap (3) template" + jQuery removed. Action only if a custom conf.php sets
|
|
`template = bootstrap` or lists bootstrap templates — our template mounts no conf.php (image default config). A viewer's
|
|
saved template cookie is irrelevant unless template switching is enabled (default off). No data conversion.
|
|
Lane: SECURITY_FIX.
|
|
Classifier note: none.
|