Skip to content

Conversation

@kenjis
Copy link
Member

@kenjis kenjis commented May 24, 2023

Description
composer audit uses GitHub Security Advisory Database.
https://github.com/advisories?query=codeigniter4
So now we don't need to send PR to FriendsOfPHP/security-advisories.

$ php spark | head -2

CodeIgniter v4.3.4 Command Line Tool - Server Time: 2023-05-23 23:59:12 UTC+00:00
$ composer audit
Info from https://repo.packagist.org: #StandWithUkraine
Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | codeigniter4/framework                                                           |
| CVE               | CVE-2023-32692                                                                   |
| Title             | Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4   |
| URL               | https://github.com/advisories/GHSA-m6m8-6gq8-c9fj                                |
| Affected versions | <4.3.5                                                                           |
| Reported at       | 2023-05-22T19:49:11+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

Checklist:

  • Securely signed commits
  • [] Component(s) with PHPDoc blocks, only if necessary or adds value
  • [] Unit testing, with >80% coverage
  • [] User guide updated
  • [] Conforms to style guide

@kenjis kenjis merged commit a724f92 into codeigniter4:develop May 25, 2023
@kenjis kenjis deleted the update-RELEASE.md branch May 25, 2023 23:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants