Skip to content

Addressed issues#

Issues addressed in the MSR 2.10.2 release include:

  • [ENGDTR-5092] Set ReadHeaderTimeout (10s) on product http.Server instances in the admin API and Garant token server to mitigate Slowloris-style denial-of-service attacks using incomplete HTTP request headers.
  • [ENGDTR-5224] Rejection of archive members whose cleaned path would escape the destination directory in dtrutil.Untar (Zip Slip); used when applying offline vulnerability database updates.
  • [ENGDTR-5055] Appliance network-settings field errors are rendered with textContent instead of innerHTML.
  • [ENGDTR-5113] Replacing of tempfile.mktemp with NamedTemporaryFile when writing temporary CA files for storage/RabbitMQ verification.
  • [ENGDTR-2725] Removed an unused workspace-level swagger-ui@3.23.11 dependency that pulled in vulnerable autolinker@0.28.1 via remarkable@1.7.4. The MSR UI continues to use swagger-ui@^3.27.0, which resolves to autolinker@3.14.1. Repository README rendering is unaffected; it uses react-markdown, not remarkable.