You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by jl...@apache.org on 2025/06/02 23:36:58 UTC
(superset) branch 4.1 updated: docs: CVEs fixed on 4.1.2 (#33435)
This is an automated email from the ASF dual-hosted git repository.
jli pushed a commit to branch 4.1
in repository https://gitbox.apache.org/repos/asf/superset.git
The following commit(s) were added to refs/heads/4.1 by this push:
new dc23fcd9f1 docs: CVEs fixed on 4.1.2 (#33435)
dc23fcd9f1 is described below
commit dc23fcd9f1cc62cfe37d42f723e485b30dbb6af8
Author: sha174n <10...@users.noreply.github.com>
AuthorDate: Wed May 14 18:36:58 2025 +0100
docs: CVEs fixed on 4.1.2 (#33435)
(cherry picked from commit 8a8fb49617a5621399fb9164207b9bdd3f385542)
---
docs/docs/security/cves.mdx | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/docs/docs/security/cves.mdx b/docs/docs/security/cves.mdx
index 4ac0bb5296..e61d860216 100644
--- a/docs/docs/security/cves.mdx
+++ b/docs/docs/security/cves.mdx
@@ -2,6 +2,21 @@
title: CVEs fixed by release
sidebar_position: 2
---
+#### Version 4.1.2
+
+| CVE | Title | Affected |
+|:---------------|:-----------------------------------------------------------------------------------|---------:|
+| CVE-2025-27696 | Improper authorization leading to resource ownership takeover | < 4.1.2 |
+
+#### Version 4.1.0
+
+| CVE | Title | Affected |
+|:---------------|:-----------------------------------------------------------------------------------|---------:|
+| CVE-2024-53947 | Improper SQL authorisation, parse for specific postgres functions | < 4.1.0 |
+| CVE-2024-53948 | Error verbosity exposes metadata in analytics databases | < 4.1.0 |
+| CVE-2024-53949 | Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled | < 4.1.0 |
+| CVE-2024-55633 | SQLLab Improper readonly query validation allows unauthorized write access | < 4.1.0 |
+
#### Version 4.0.2
| CVE | Title | Affected |