diff --git a/website/docs/releases/2024/v2024.10.md b/website/docs/releases/2024/v2024.10.md index d8edae393c..4fe73828a0 100644 --- a/website/docs/releases/2024/v2024.10.md +++ b/website/docs/releases/2024/v2024.10.md @@ -157,6 +157,22 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.10 - stages/password: use recovery flow from brand (cherry-pick #11953) (#11969) - web: bump API Client version (#11992) +## Fixed in 2024.10.3 + +- core: fix source_flow_manager throwing error when authenticated user attempts to re-authenticate with existing link (cherry-pick #12080) (#12081) +- internal: add CSP header to files in `/media` (cherry-pick #12092) (#12108) +- providers/ldap: fix global search_full_directory permission not being sufficient (cherry-pick #12028) (#12030) +- providers/scim: accept string and int for SCIM IDs (cherry-pick #12093) (#12095) +- rbac: fix incorrect object_description for object-level permissions (cherry-pick #12029) (#12043) +- root: check remote IP for proxy protocol same as HTTP/etc (cherry-pick #12094) (#12097) +- root: fix activation of locale not being scoped (cherry-pick #12091) (#12096) +- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.md), reported by [@matt1097](https://github.com/matt1097) (#12117) +- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.md), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113) +- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.md), reported by [@mgerstner](https://github.com/mgerstner) (#12115) +- web/admin: better footer links (#12004) +- web/flows: fix invisible captcha call (cherry-pick #12048) (#12049) +- website/docs: add CSP to hardening (cherry-pick #11970) (#12116) + ## API Changes ### API Changes in 2024.10.0 diff --git a/website/docs/releases/2024/v2024.8.md b/website/docs/releases/2024/v2024.8.md index 2544f8da07..cba41ef161 100644 --- a/website/docs/releases/2024/v2024.8.md +++ b/website/docs/releases/2024/v2024.8.md @@ -300,6 +300,14 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.8 - web/admin: fix invalid create date shown for MFA registered before date was saved (cherry-pick #11728) (#11729) - web/admin: fix sync single button throwing error (cherry-pick #11727) (#11730) +## Fixed in 2024.8.5 + +- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.md), reported by [@matt1097](https://github.com/matt1097) (#12114) +- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.md), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113) +- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.md), reported by [@mgerstner](https://github.com/mgerstner) (#12115) +- web/admin: better footer links (#12004) +- web: bump API Client version (#12118) + ## API Changes #### What's New