Metabaseに複数の脆弱性、0.64.3.4以降の修正版が公開
Summary
BIツールのMetabaseが、セキュリティ強化を目的とした64系の更新で、入力検証・権限確認・情報露出まわりの脆弱性をまとめて修正しました。Metabaseを自社で運用している組織が対象で、修正版への更新と、更新後の設定の見直しが必要です。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
BIツールのMetabaseが、セキュリティ強化を目的とした64系の更新で、入力検証・権限確認・情報露出まわりの脆弱性をまとめて修正しました。Metabaseを自社で運用している組織が対象で、修正版への更新と、更新後の設定の見直しが必要です。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| other | metabase |
>= x.64.0, < x.64.3.4 |
x.64.3.4 |
Original description The description as published by the source.
Metabase 64 is our security hardening release, with a batch of security fixes, a reduced attack surface, and more control over your instance. It is also a Long Term Support (LTS) release.
The release announcement and changelog describe improvements including:
- Additional input validation for APIs and query compilation, covering values such as filters, date units, regular expressions and type casts. It strengthens permission checks for referenced models, metrics and questions.
- Reduced metadata exposure in public and embedded responses, plus tighter checks around trashed content and tenant-specific endpoints and subscription recipients.
- Improvements to login-session handling when users are deactivated or reactivated, plus removal of database secrets from serialization exports. Supported email-domain restrictions receive additional checks when sending alerts and subscriptions, where configured.
- Controls for outbound connections, with network-policy settings for supported warehouse connections, webhooks, map tiles and AI providers. Pro and Enterprise admins can require two-factor authentication for password and LDAP sign-ins, with a grace period.
- Optional session-signing and encryption keys are available across editions. When configured, they help protect application sessions and supported sensitive values in the application database, including credentials and notification-recipie…
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY metabase/metabase