CVE-2024-37568

Advisory

Assemblyline updates authlib library to address CVE-2024-37568 vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Bugfixes

- Update authlib library to address CVE-2024-37568 vulnerability
- Handle cases where the value of identity_id was never assigned (https://github.com/CybercentreCanada/assemblyline/issues/315)

Features

- Submission Profiles
- This allows you to pre-configure profiles for users and also set restrictions on what's allowed to be changed
- This introduces the role of `submission_customize` which grants the user the ability to change their submission profile as they desire (should be given to all users by default) but administrators are allowed to remove this role as they see fit.

- Update Sources: Support for supplying JSON data for POST requests (https://github.com/CybercentreCanada/assemblyline/issues/248)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37568