Packagist/ibexa/graphql: critical
GraphQL queries can expose password hashes
Action: Upgrade ibexa/graphql to 2.5.31 or later.
composer require ibexa/graphql:2.5.31composer require ibexa/graphql:4.2.3composer require ibexa/graphql:3.3.28Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.5.0 | 2.5.31 | - |
| 4.2.0 | 4.2.3 | - |
| 3.3.0 | 3.3.28 | - |
Fixed versions
| 2.5.31 | 4.2.3 | 3.3.28 |
Sources
- osv: GHSA-3p7g-wrgg-wq45
- https://github.com/ibexa/graphql/security/advisories/GHSA-3p7g-wrgg-wq45
- https://github.com/ibexa/graphql/commit/5ae5fb4d1d292ddde8528e040ef8a7c8dd7f9c6d
- https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips
- https://github.com/ibexa/graphql
published · modified · JSON