| ID | PPSA-202404-2 |
|---|---|
| Published | 2024-04-08 |
| Private Packagist Cloud | Affected. Fixed on 2024-04-08. |
| Private Packagist Self-Hosted (KOTS) | Affected < 2.0.3. Fixed in 2.0.3. |
| Private Packagist Self-Hosted (Replicated Native) | Affected < 1.12.5. Fixed in 1.12.5. |
Summary
Members of the billing team could add packages from mirrored third-party repositories to the organization, although the billing team is not meant to manage packages.
Who was affected
Organizations on Private Packagist Cloud until the fix on April 8, 2024, and on Private Packagist Self-Hosted installations running a version before 2.0.3 (KOTS) or 1.12.5 (Replicated Native).
Impact
A member of the billing team could have added packages by name to the organization from mirrored third-party repositories that were already configured in the organization. They could not add, change, or remove the mirrored third-party repositories themselves.
What we did
Billing team members can no longer add packages from mirrored third-party repositories.
Do customers need to do anything
- Private Packagist Self-Hosted: Upgrade to 2.0.3 (KOTS) or 1.12.5 (Replicated Native) or any later version. We recommend upgrading to the latest release.
- Private Packagist Cloud: No action is required.
Start Free Trial
Login to create an organization and start your free trial!