Page MenuHomePhabricator

Update Sentry to 8.2.2
Closed, DeclinedPublic

Description

Sentry 8.2.2 / 8.1.4 is a security update. Code execution vulnerability that's only exploitable by Sentry superusers, so nothing too urgent.

Event Timeline

Tgr created this task.Mar 4 2016, 9:16 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 4 2016, 9:16 PM
Tgr added a comment.Mar 29 2016, 6:04 PM

8.2.4 / 8.1.5 is another security update. "If being run in multi-organization mode, it was possible for a user to craft a URL which would allow them to view membership details of other users." - not a big deal.

Gilles has pointed out that Sentry 8 dropped MySQL support. Our PostgreSQL puppet roles need a lot of love, so this upgrade will be a big task.

Reedy added a subscriber: Reedy.Nov 4 2016, 1:25 AM

8.2.5 is also another security update "Fixed a bug which allows API keys more permission than granted within the organization."

But they're upto 8.10.0 now...

Tgr added a comment.Nov 4 2016, 1:55 AM

And apparently stopped announcing security updates on the mailing list :/

But they're upto 8.10.0 now...

The release cycle has roughly been one release per month.
(In my organisation the Sentry instances run using Docker and docker-compose, using the on-premise setup, which takes away most of the upgrade pain).

Quennlatifa0303 renamed this task from Update Sentry to 8.2.2 to Update Sentry to 8..Feb 19 2019, 4:05 AM
Quennlatifa0303 triaged this task as Unbreak Now! priority.
Restricted Application added subscribers: Liuxinyu970226, TerraCodes. · View Herald TranscriptFeb 19 2019, 4:05 AM
Krinkle renamed this task from Update Sentry to 8. to Update Sentry to 8.2.2.Feb 19 2019, 4:10 AM
Krinkle lowered the priority of this task from Unbreak Now! to Needs Triage.
Krinkle removed subscribers: TerraCodes, Liuxinyu970226.
chasemp triaged this task as High priority.Dec 9 2019, 5:22 PM
Aklapper removed Tgr as the assignee of this task.Jun 19 2020, 4:18 PM

This task has been assigned to the same task owner for more than two years. Resetting task assignee due to inactivity, to decrease task cookie-licking and to get a slightly more realistic overview of plans. Please feel free to assign this task to yourself again if you still realistically work or plan to work on this task - it would be welcome!

For tips how to manage individual work in Phabricator (noisy notifications, lists of task, etc.), see https://phabricator.wikimedia.org/T228575#6237124 for available options.
(For the records, two emails were sent to assignee addresses before resetting assignees. See T228575 for more info and for potential feedback. Thanks!)

Tgr closed this task as Declined.Jun 20 2020, 2:37 PM

Sentry is at 10.0 now (actually, 20.6, but they have changed their versioning schema) so this task is a bit pointless.