Outdated APK version on App Store
- Dominant language
- C
- Stars
- 20.5k
- Forks
- 1.5k
- PR merge metrics
- No merged PRs in 30d
Description
It looks like the APK version was updated to 3.19 about six months ago in master, but the App Store build still hasn't been updated with this version.
This means that the App Store version is still using the 3.14 repository, which appears to contain out of date packages that could present a security risk.
For example, the version of OpenSSH in this repository is 8.6p1, which is more than three years out of date and has some nasty CVEs. Although they are unlikely to escape the sandbox, sensitive data _inside_ the sandbox such as private keys could still be exfiltrated if it were compromised.
Assuming that there are more than a few users that intend to use iSH for remote management or other tasks that require the use of SSH, this is a security hole that should be closed.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by comparing the 3.19 version in master with the 3.14 App Store repository and checking the OpenSSH and other package versions mentioned in the report. Done means the App Store build is updated to 3.19 and no longer ships the reported outdated packages.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios
- Domain
- mobile, release, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100