This release contains multiple fixes for security issues related to helm command injection.
Those fixes have been backported to previous Onyxia-API major versions
Read more here : https://docs.onyxia.sh/vulnerability-disclosure
Security ⚠️
- Sanitize helm names and namespace (#542) @olevitt
- Fix arbitrary Helm list parameter injection in GET /my-lab/app (#540) @nicolst
- Fix command injection vulnerability in HelmInstallService (#539) @nicolst
Changes
- Allow JMX debug (#536) @olevitt
- Further options for filtering catalog services (#532) @mmwinther
- Add username to logs (#526) @olevitt