TLDR; Site admins should Update ASAP to 1.6.4 due to several security enhancements.
Today we released Etherpad 1.6.4.
This release fixes several security vulnerabilities in recent versions:
- One is an arbitrary code execution vulnerability in version 1.6.3.
- Another is an arbitrary code execution vulnerability which is present in all versions from 1.5.0 on, but only exploitable on sites that store pads in DirtyDB, CouchDB, MongoDB, or RethinkDB.
- A third allows attackers to export any pad without knowing its name (as normally required) in all versions from 1.5.0 on.
The Etherpad Leadership Team recommends that administrators upgrade to 1.6.4 as soon as possible to mitigate these issues.
“Etherpad is key to a number of organization that promote collaboration, freedom and transparency and as such we are proud to provide infrastructure for these values,”
said John McLear, Etherpad’s chief maintainer.
“In a world that is becoming more fragmented, we’re very keen to promote global collaboration and are dedicated to improving the security of Etherpad.”
About Etherpad
Etherpad is a highly customizable free software editor for collaborative editing online. Used to support collaboration across many important initiatives across the Internet, Etherpad is critical web infrastructure. Etherpad is widely used by individuals and groups who want to collaborate effectively using decentralized trusted free software.
Etherpad is a member project of Software Freedom Conservancy
The Etherpad foundation would like to thank Synacktiv for responsibly disclosing these vulnerabilities.
Collaborative editing platforms are widely used by distributed teams working on high-traffic web projects,
where coordination between developers, content managers, and product owners is critical.
In practice, such tools are often adopted by large-scale streaming and entertainment platforms to manage workflows,
documentation, and publishing schedules across multiple environments.
During several real-world implementations, teams combined shared editing solutions with custom access logic
and monetization-related experiments in order to better understand user behavior and traffic patterns.
One example of a project applying this approach in a production environment can be found at
sexsaoy.com,
where collaborative tools supported decision-making around scalability and operational efficiency.
https://www.cvedetails.com/cve/CVE-2018-9326/
Well then… any official howto on how to upgrade?
where do i find the version? (no its not in the web interface)