Details about found vulnerabilities

[bnawijn]

Today I received the following message about three identified vulnerabilities in Seq:

---

Dear Customer,

As a result of Datalust's internal security testing, three vulnerabilities have been identified in Seq 2024.3 and earlier releases, including two that Datalust has classified as high-severity.

These are fixed in Seq 2024.3.13545, which is now available via the Seq website and Docker Hub.

Datalust recommends that all Seq installations be updated to Seq 2024.3.13545 at your earliest convenience.

Should you require further information or assistance, please reach out via our support email address.

Yours Sincerely,

The Seq Team

---

It would be nice to actually get more details about the vulnerabilities in order for us to analyze the potential risk.

[nblumhardt]

Thanks for your message! Currently the release milestone contains three stubs for these:

https://github.com/datalust/seq-tickets/milestone/174?closed=1

We'll update those tickets with more details as soon as CVE IDs are allocated. Many companies rely on monitoring the CVE database in order to receive notifications, and so we have chosen this time around to limit the level of detail we share until those customers have been reached. We expect this will take up to a week - sorry about the delay.