Pi-hole Web v5.5.1 Security und Bugfix Release veröffentlicht

Pi-hole ist ein kostenloser DNS Server mit Werbeblocker. Das Update von FTL (Faster-Than-Light) auf Version 5.6 behebt einige Fehler der vorherigen Versionen. Das Update wird mit folgendem Befehl ausgeführt:

# pihole -up

Pi-hole FTL 5.5.1 Release Notes

• GHSA-g3w6-q4fg-p8x8 – “Stored XSS Vulnerability in the Pi-hole Webinterface” reported by both Dariusz Gońda and @awareseven
• GHSA-5cm9-6p3m-v259 – “(Authenticated) Remote Code Execution Possible in Web Interface 5.5” reported by @SchneiderSec

Docker

The :v5.8.1 docker image has been re-tagged to include this hotfix, but it also allowed us to bring in some (non-breaking) housekeeping and changes to the build process of the container at the same time.

Docker Specific Changes:

• [BugFix] Ignore SKIPGRAVITYONBOOT if gravity.db does not exist #881
• [BugFix-BugFix] Fix gravityDB check #883
• [BugFix] Remove Unneccessary kill -9 #888
• [BugFix] Remove no longer needed workaround for resolvconf #882
• [BugFix] Remove obsolete debconf-apt-progress workaround #879
• [Docs] Add documentation for WEBPASSWORD_FILE #869
• [Docs] Fix DNS_BOGUS_PRIV description #857
• [Docs] Small correction in the ‘Quick Start’ section of the README #886
• [Docs] Update README.md to add changes in #867 #873
• [Docs] Use nginxproxy’s DockerHub registry #890
• [Housekeeping] Remove broken doco-example.yml symlink #737
• [Infrasctucture] Switch multiarch/debian-debootstrap to pihole/debian-debootstrap to fix build issues #892
• [Infrastructure] Single versions file #861
• [Infrastructure] install.sh overhaul #843
• [New Feature] Add CACHE_SIZE environment variable to the available options #689
• [New Feature] Adding CORS_HOSTS to PHP environment #867
• [New Feature] Introduced WEBTHEME environment variable to control user interface theme selection. #856

These fixes are also in both the beta branch for the web interface, and the :beta-v5.9 docker image.

Quelle: [Hotfix] Pi-hole Web v5.5.1 released – Pi-hole