ish-app / ish-app/ish

Outdated APK version on App Store

Open
#2,429 2 comments 14 reactions 0 assignees View on GitHub
unconfirmed
Dominant language
C
Stars
20.5k
Forks
1.5k
PR merge metrics
No merged PRs in 30d

Description

It looks like the APK version was updated to 3.19 about six months ago in master, but the App Store build still hasn't been updated with this version.

This means that the App Store version is still using the 3.14 repository, which appears to contain out of date packages that could present a security risk.

For example, the version of OpenSSH in this repository is 8.6p1, which is more than three years out of date and has some nasty CVEs. Although they are unlikely to escape the sandbox, sensitive data _inside_ the sandbox such as private keys could still be exfiltrated if it were compromised.

Assuming that there are more than a few users that intend to use iSH for remote management or other tasks that require the use of SSH, this is a security hole that should be closed.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by comparing the 3.19 version in master with the 3.14 App Store repository and checking the OpenSSH and other package versions mentioned in the report. Done means the App Store build is updated to 3.19 and no longer ships the reported outdated packages.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios
Domain
mobile, release, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.