From dfa333152475d2855330dff23b4f6f4ad73a4093 Mon Sep 17 00:00:00 2001 From: Goutham Veeramachaneni Date: Wed, 28 Apr 2021 15:03:49 +0200 Subject: [PATCH] Update changelog for 1.9 release in progress. Signed-off-by: Goutham Veeramachaneni --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6147b7e3075..6fcc89f37d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## master / unreleased +## 1.9.0 in progress + * [CHANGE] Fix for CVE-2021-31232: Local file disclosure vulnerability when `-experimental.alertmanager.enable-api` is used. The HTTP basic auth `password_file` can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list. #4129 * [CHANGE] Alertmanager now removes local files after Alertmanager is no longer running for removed or resharded user. #3910 * [CHANGE] Alertmanager now stores local files in per-tenant folders. Files stored by Alertmanager previously are migrated to new hierarchy. Support for this migration will be removed in Cortex 1.11. #3910