Uptime Kuma 2.5.4 → 2.5.9
5 releases · 0 breaking changes · 6 security fixes · 2 advisories fixed
6security0breaking0deprecated0feature10fix
Vulnerabilities fixed by this upgrade
- 4.3 GHSA-86ch-2247-gr56 Unauthenticated Host-header injection and RSS cache poisoning
- medium GHSA-98hr-q8q8-5j23 Rootless privilege escalation
Breaking changes
None in the release notes.
Security changes
- security GHSA-86ch-2247-gr56 fix: RSS cache poisoning (Thanks @the-arma-of-owl) in 2.5.9
- security #8080 chore: drop outdated apicache, migrate to http-cache-semantics (related to the above issue) in 2.5.9
- security #8050 chore: Update dependencies in 2.5.9
- security GHSA-v2p3-6f5h-6hhf [Admin Only] RCE (Thanks @Sami111-Afk) (Open a help issue to ask to reveal it after 7 days, in case i forget to) in 2.5.8
- security [Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv) in 2.5.7
- security #7858 chore: Update dependencies in 2.5.6
Every release in between
fix#8082 fix: runtime timeout fallback used milliseconds for a seconds field
fix#8081 fix: reset push monitor retries from the last stored heartbeat
fix#8079 fix: remove duplicated refresh timer on status page
fix#8064 fix: display recurring maintenance in its configured timezone (Thanks @kuxiaowo)
securityGHSA-86ch-2247-gr56 fix: RSS cache poisoning (Thanks @the-arma-of-owl)
security#8080 chore: drop outdated apicache, migrate to http-cache-semantics (related to the above issue)
security#8050 chore: Update dependencies
fix#8049 fix: Docker verification check sometimes not catching invalid responses (2.5.X backport) (Thanks @Abestanis)
fix#8038 fix: add next-slim-rootless docker tag
fix#8028 fix: drop TLS support from the TCP Port monitor (It never worked as expected and very buggy, all existing monitors will become normal TCP monitors)
securityGHSA-v2p3-6f5h-6hhf [Admin Only] RCE (Thanks @Sami111-Afk) (Open a help issue to ask to reveal it after 7 days, in case i forget to)
other#8037 revert: hide/show password toggle in login page (#7672) (Because the height is inconsistent)
fix#7989 fix: retries ignored by TCP Port monitor with SSL/STARTTLS
security[Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv)
fix#7886 fix: use UptimeCalculator for avg-response badge endpoint
security#7858 chore: Update dependencies
fix#7848 fix: Memory leak from tcp monitor