Four releases today: 4.4.1, 4.3.5, 4.2.6 and 3.9.12. All patch releases, no database changes, mostly security fixes.
It took longer than I wanted. Summer got in the way and I had less time to sit down and concentrate, while the reports kept coming in. So it’s a bigger batch than usual.
What got fixed
The full advisories are on the security page of the repository. Short version:
Permission templates could be assigned without proper checks, on the web and through the API, so a normal user could end up as superuser. API user creation without a template also defaulted to Administrator. Now it’s the minimal template.
API keys kept working after their owner was deactivated.
Zone name, type and primary could be changed through the API with only record editing rights. Now it needs the zone metadata permission, same as the web form.
Template records were readable across templates and were never validated.
The SOA and NS restriction for client level editors could be bypassed by switching the record type. LUA records are now restricted the same way, everywhere.
Bulk zone and record deletion skipped the CSRF and permission checks. A few GET links also changed state without a token.
Second factor codes had no attempt limit and the email code came from mt_rand(). Now rate limited, proper random, and the recovery code still works during a lockout.
The session key generator was weak and the warning for the default key never fired. If you still run the shipped key you’ll see a warning until you change it.
Emailed links, OIDC and SAML URLs and the logout URL could fall back to SERVER_NAME. They are now built only from interface.application_url, so set it if you use password reset or SSO.
OIDC and SAML trusted an unverified email claim and fell back to Administrator when the default template was missing. Both closed.
The installer trusted X-Forwarded-For from anyone.
Login timing leaked whether a username existed, and some token comparisons were not constant time.
On top of that the usual bugs: mixed IPv4 and IPv6 in dynamic DNS updates, dark mode contrast, zone identity in API backend mode, Docker config generation, and env variables for all of the 4.4.0 settings.
Release notes: 4.4.1, 4.3.5, 4.2.6, 3.9.12. Read the upgrading section before rolling out, a few of these change behaviour that API clients or SSO setups may depend on.
Which version to run
4.3.x is still the line I recommend for production, 4.3.5 is the one to take. 4.4.x is the current feature line and 4.4.1 is holding up well. 4.2.x is winding down. I said 4.2.5 would probably be the last one and here is 4.2.6, but this time plan on it and move to 4.3.x. 3.x stays supported until December 2027 for those who cannot upgrade yet.
Docker tags: stable follows 4.3.x, latest follows master, lts follows 3.x, and every release has its own v4.4.1 style tag. If you run latest, read the next section.
Heads-up about master and 4.5.0
I’m planning to merge develop into master soon. It carries the 4.5.0 work and is still in testing, so master may be unstable for a while. If you build from git or run the latest image, pin a release tag for now.
What is coming in 4.5.0: DNSSEC key management with rollover, an SOA serial policy per zone, presigned zone support, a headless mode with health endpoints for API only setups, and a finer permission split for viewing, logs and DNSSEC. Also one removal: the v1 API is gone in 4.5.0 and answers 410. It has been deprecated since 4.3.0, so if you still have scripts on /api/v1/, move them to v2 before the next minor.
Thanks
Big thanks to everyone who spent their own time digging through the code, writing reports and waiting for the fix. It makes the project better for everyone who runs it.
Security reports:
Shameer Kashif (hash3liZer) and Khizar Ali Shah (eros938)
Jace (manus-use)
Eurico Nicacio (euriconicacio)
Wesley Wang (Zyy0530)
Nijat Sultanov (Sultan0f1)
Zulfugar Huseynli (pentestz)
Arpit Jain (arpitjain099)
ThanhVu (StarPlatinu)
Markus Magnuson (alimony)
Bugs and pull requests: DrGeek, pomland-94, bessone, monalisa-overdrive, pk-lee-developer, aurel8812, hatclub.
Support
This still takes a lot of time and energy, and motivation swings. Open source without any backing sometimes feels a bit pointless, so if Poweradmin is useful to you or your company, consider chipping in:
Companies can get a proper invoice: through Open Collective for anyone, anywhere, or directly from me if you are in the EU. And if you need a specific feature sooner, feature sponsorship is an option. Ping me on GitHub.