2.3 KiB
2.3 KiB
romm — triage (pin rommapp/romm:5.3.1; sidecars mariadb:11.8, redis:7-alpine not in scope)
Template: setup_gate: true only; KIOSK_MODE not set (off); X-Forwarded-For stripped by traefik middleware romm-xff.
Notices (4 GHSA + 2 release hits)
| id | sev | verdict | login | reachable |
|---|---|---|---|---|
| GHSA-722m-w9p2-xv2j | high | REAL (<5.4.0): Socket.IO scan/scan:stop unauthenticated; a complete scan deletes all on-disk media and rewrites ROM rows |
none | YES — /ws/socket.io on the public subdomain, no upstream auth after setup |
| GHSA-q7fg-rj3q-m3gm | medium | REAL: read others' private collections/favourites via /api/roms filters (anonymous only with KIOSK_MODE, off here) | any user | yes |
| GHSA-7jw3-ppmp-57wc | medium | REAL: hidden-ROM child routes skip visibility check | any user | yes (only matters if admin hides ROMs) |
| GHSA-9q83-m866-5jrp | medium | REAL: public save download bypasses hidden-ROM check | any user | yes (same) |
| release:5.4.0 | - | REAL: release carries the 4 fixes + renovate "[security]" dependency bumps | - | - |
| release:5.4.1 | - | REAL (runtime deps): pillow v13 [security], certifi (eMudhra CA distrust), aiohttp bump, pip upgrade; Node 24.22.1 bump (likely build-stage only, unsure) | - | - |
| Real 6 / 6. Worst: high, no login, reachable. |
Fix
Smallest: 5.4.0. TARGET rommapp/romm:5.4.1 (newest stable; Hub tags 5.4.1 / 5.4 / 5; we use the non-slim tag). Same main (5): yes.
Breaking/migrations 5.3.1 -> 5.4.1 (read 5.4.0-alpha.1, -alpha.2, -beta.1, 5.4.0, 5.4.1):
- CAUTION 5.4.0: first start runs migrations that REWRITE the roms table in batches, "give 15-20 min, don't restart the container while they run". App-run DB migration (allowed by the rule) BUT a restart/rollback mid-migration is the risk — the update path must not time out and roll back during it.
- ROMM_CORS_ALLOWED_ORIGINS default now deny (same-origin UI unaffected); FORWARDED_ALLOW_IPS default now loopback/private only (traefik is on a private docker net; we strip XFF anyway).
- API ⚠ changes (removed schema fields, netplay rooms need login, scan payload validated strictly) — affect external API clients only.
- No env rename, no file layout change, no new required service (SMTP etc. optional). Lane: SECURITY_FIX (with the long-migration caution — operator may prefer to watch the first box). Classifier note: none.