25 lines
2.3 KiB
Markdown
25 lines
2.3 KiB
Markdown
# romm — triage (pin rommapp/romm:5.3.1; sidecars mariadb:11.8, redis:7-alpine not in scope)
|
|
|
|
Template: `setup_gate: true` only; KIOSK_MODE not set (off); X-Forwarded-For stripped by traefik middleware romm-xff.
|
|
|
|
## Notices (4 GHSA + 2 release hits)
|
|
| id | sev | verdict | login | reachable |
|
|
|---|---|---|---|---|
|
|
| GHSA-722m-w9p2-xv2j | high | REAL (<5.4.0): Socket.IO `scan`/`scan:stop` unauthenticated; a `complete` scan deletes all on-disk media and rewrites ROM rows | none | YES — /ws/socket.io on the public subdomain, no upstream auth after setup |
|
|
| GHSA-q7fg-rj3q-m3gm | medium | REAL: read others' private collections/favourites via /api/roms filters (anonymous only with KIOSK_MODE, off here) | any user | yes |
|
|
| GHSA-7jw3-ppmp-57wc | medium | REAL: hidden-ROM child routes skip visibility check | any user | yes (only matters if admin hides ROMs) |
|
|
| GHSA-9q83-m866-5jrp | medium | REAL: public save download bypasses hidden-ROM check | any user | yes (same) |
|
|
| release:5.4.0 | - | REAL: release carries the 4 fixes + renovate "[security]" dependency bumps | - | - |
|
|
| release:5.4.1 | - | REAL (runtime deps): pillow v13 [security], certifi (eMudhra CA distrust), aiohttp bump, pip upgrade; Node 24.22.1 bump (likely build-stage only, unsure) | - | - |
|
|
Real 6 / 6. Worst: high, no login, reachable.
|
|
|
|
## Fix
|
|
Smallest: 5.4.0. TARGET `rommapp/romm:5.4.1` (newest stable; Hub tags 5.4.1 / 5.4 / 5; we use the non-slim tag). Same main (5): yes.
|
|
Breaking/migrations 5.3.1 -> 5.4.1 (read 5.4.0-alpha.1, -alpha.2, -beta.1, 5.4.0, 5.4.1):
|
|
- CAUTION 5.4.0: first start runs migrations that REWRITE the roms table in batches, "give 15-20 min, don't restart the container while they run". App-run DB migration (allowed by the rule) BUT a restart/rollback mid-migration is the risk — the update path must not time out and roll back during it.
|
|
- ROMM_CORS_ALLOWED_ORIGINS default now deny (same-origin UI unaffected); FORWARDED_ALLOW_IPS default now loopback/private only (traefik is on a private docker net; we strip XFF anyway).
|
|
- API ⚠ changes (removed schema fields, netplay rooms need login, scan payload validated strictly) — affect external API clients only.
|
|
- No env rename, no file layout change, no new required service (SMTP etc. optional).
|
|
Lane: SECURITY_FIX (with the long-migration caution — operator may prefer to watch the first box).
|
|
Classifier note: none.
|