Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

ibexa/post-install

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    ibexa/post-install affected by Breach with Varnish VCL

    GHSA-4h8f-c635-25p7

    Affected
    • Packagist ibexa/post-install >= 1.0.0, < 1.0.16; >= 4.6.0, < 4.6.14
    Fixed in
    1.0.164.6.14· Vendor fix available
    Issue
    Impact This is not a vulnerability in the code per se, but included platform.sh Varnish VCL templates and Apache/Nginx vhost templates enable compression of API and JSON messages. This is a potential case of the BREACH vulnerability, which affects HTTP compression, where secrets can be extracted through carefully crafted requests. The fix disables compression in these templates. Please make sure to make the same change in your configuration files, see the release notes for specific instructions. Patches - See "Patched versions". - v1.0: https://github.com/ibexa/post-install/commit/d91cc02623dd3263a99a94ace133c95e48909e5d - v4.6: https://github.com/ibexa/post-install/commit/ae7c3c2081a862c75b90828f08bd74436ceb8fe8 Workarounds Make sure HTTP compression is disabled for REST API requests and other communication that might contain secrets. References - Advisory:…

    Recommended action: Upgrade to 4.6.14 or 1.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. UnratedPackagistPublished

    Any storage file can be downloaded from p.sh if full server path is known

    GHSA-gqcf-83rq-gpfr

    Affected
    • Packagist ibexa/post-install <= 1.0.4
    Fixed in
    1.0.4.1· Vendor fix available
    Issue
    The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.

    Recommended action: Upgrade to 1.0.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →