diff --git a/SECURITY.md b/SECURITY.md index 2f36fac8..dc763184 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -3,3 +3,27 @@ ## Reporting a Vulnerability Please report security issues to ozzie.fernandez.isaacs@googlemail.com + +## Supported Versions + +To receive fixes for security vulnerabilities it is required to always upgrade to the latest version of Calibre-Web. See https://github.com/janeczku/calibre-web/releases/latest for the latest release. + +## History + +| Fixed in | Description |CVE number | +| ---------- |---------|---------| +| 3rd July 2018 | Guest access acts as a backdoor|| +| V 0.6.7 |Hardcoded secret key for sessions |CVE-2020-12627 | +| V 0.6.13|Calibre-Web Metadata cross site scripting |CVE-2021-25964| +| V 0.6.13|Name of Shelves are only visible to users who can access the corresponding shelf Thanks to @ibarrionuevo|| +| V 0.6.13|JavaScript could get executed in the description field. Thanks to @ranjit-git || +| V 0.6.13|JavaScript could get executed in a custom column of type "comment" field || +| V 0.6.13|JavaScript could get executed after converting a book to another format with a title containing javascript code|| +| V 0.6.13|JavaScript could get executed after converting a book to another format with a username containing javascript code|| +| V 0.6.13|JavaScript could get executed in the description series, categories or publishers title|| +| V 0.6.13|JavaScript could get executed in the shelf title|| +| V 0.6.13|Login with the old session cookie after logout. Thanks to @ibarrionuevo|| +| V 0.6.14|CSRF was possible. Thanks to @mik317 || +| V 0.6.14|Cross-Site Scripting vulnerability on typeahead inputs. Thanks to @notdodo|| + + diff --git a/cps/constants.py b/cps/constants.py index 367bc29d..012d0d39 100644 --- a/cps/constants.py +++ b/cps/constants.py @@ -151,7 +151,7 @@ def selected_roles(dictionary): BookMeta = namedtuple('BookMeta', 'file_path, extension, title, author, cover, description, tags, series, ' 'series_id, languages, publisher') -STABLE_VERSION = {'version': '0.6.14 Beta'} +STABLE_VERSION = {'version': '0.6.14'} NIGHTLY_VERSION = {} NIGHTLY_VERSION[0] = '$Format:%H$' diff --git a/optional-requirements.txt b/optional-requirements.txt index af068a51..cfa2bfc3 100644 --- a/optional-requirements.txt +++ b/optional-requirements.txt @@ -1,5 +1,5 @@ # GDrive Integration -gevent>20.6.0,<21.2.0 +gevent>20.6.0,<22.0.0 greenlet>=0.4.17,<1.2.0 httplib2>=0.9.2,<0.20.0 oauth2client>=4.0.0,<4.1.4 diff --git a/setup.cfg b/setup.cfg index 58213f47..76f7e405 100644 --- a/setup.cfg +++ b/setup.cfg @@ -18,6 +18,7 @@ classifiers = Development Status :: 5 - Production/Stable License :: OSI Approved :: GNU Affero General Public License v3 Programming Language :: Python :: 3 + Programming Language :: Python :: 3.5 Programming Language :: Python :: 3.6 Programming Language :: Python :: 3.7 Programming Language :: Python :: 3.8 @@ -56,7 +57,7 @@ install_requires = [options.extras_require] gdrive = google-api-python-client>=1.7.11,<2.1.0 - gevent>20.6.0,<21.2.0 + gevent>20.6.0,<22.0.0 greenlet>=0.4.17,<1.2.0 httplib2>=0.9.2,<0.20.0 oauth2client>=4.0.0,<4.1.4 diff --git a/test/Calibre-Web TestSummary_Linux.html b/test/Calibre-Web TestSummary_Linux.html index 7cdaa5a0..1733a51a 100644 --- a/test/Calibre-Web TestSummary_Linux.html +++ b/test/Calibre-Web TestSummary_Linux.html @@ -37,20 +37,20 @@
Start Time: 2021-10-29 07:17:17
+Start Time: 2021-10-30 19:49:15
Stop Time: 2021-10-29 10:46:29
+Stop Time: 2021-10-30 23:31:02
Duration: 2h 49 min
+Duration: 3h 2 min
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_delete_database.py", line 77, in test_delete_books_in_database - self.assertEqual("", bl['table'][0]['selector']['text']) -AssertionError: '' != 'No matching records found' -+ No matching records found-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_edit_books_list.py", line 287, in test_list_visibility - self.assertEqual(9, len(bl['column_elements'])) -AssertionError: 9 != 17-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_edit_ebooks_gdrive.py", line 928, in test_watch_metadata - self.assertNotIn('series', book) -AssertionError: 'series' unexpectedly found in {'id': 5, 'reader': [], 'title': 'testbook', 'author': ['John Döe'], 'rating': 0, 'languages': ['English'], 'identifier': [], 'cover': '/cover/5?edit=7a19f85c-19e9-45b0-ba12-3c54b9b88d6d', 'tag': [], 'publisher': ['Randomhäus'], 'pubdate': 'Jan 19, 2017', 'comment': 'Lorem ipsum dolor sit amet, consectetuer adipiscing elit.Aenean commodo ligula eget dolor.Aenean massa.Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus.Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem.Nulla consequat massa quis enim.Donec pede justo, fringilla vel, aliquet nec, vulputate', 'add_shelf': [], 'del_shelf': [], 'edit_enable': True, 'kindle': None, 'kindlebtn': None, 'download': ['EPUB (6.7 kB)'], 'read': False, 'archived': False, 'series_all': 'Book 1 of test', 'series_index': '1', 'series': 'test', 'cust_columns': []}-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_kobo_sync_big.py", line 278, in test_kobo_sync_selected_shelfs - self.assertIn("NewTag", data3[2]) -IndexError: list index out of range-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_kobo_sync_big.py", line 185, in test_sync_changed_book - self.assertTrue('ChangedEntitlement' in data[0][0]) -IndexError: list index out of range-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_kobo_sync_big.py", line 200, in test_sync_shelf - self.assertEqual(1, len(data[0])) -AssertionError: 1 != 0-
Traceback (most recent call last): - File "/home/ozzie/Development/calibre-web-test/test/test_shelf.py", line 447, in test_adv_search_shelf - self.assertEqual(len(self.adv_search({u'exclude_shelf': u'Search', 'book_title': 'book'})), 5) -AssertionError: 0 != 5-