<html><head>
<style id="css_styles">
blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: 'Avenir Next'; font-size: 10.5pt; }
.quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }
a.em-mention[href] { text-decoration: none; color: inherit; border-radius: 3px; padding-left: 2px; padding-right: 2px; background-color: #e2e2e2; }
._em_placeholder {color: gray; border-bottom: 1px dotted lightblue;} ._em_placeholder:before{color:gray; content: '{{ ';} ._em_placeholder:after{color:gray; content: ' }}';}
</style>
</head>
<body style="color: rgb(0, 0, 0); overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><br /></div><div><div id="xb88fe02089f2495eae99d1ee657b1103"><div style="margin: 0px;"><br /></div><div style="margin: 0px;">INEX is pleased to announce the immediate availability of IXP Manager v7.3.0. This is primarily a security release following a responsible disclosure and subsequent internal hardening. Both issues have a high severity. This release also includes some bug fixes, improvements, and new features.</div><div style="margin: 0px;"><br /></div><div style="margin: 0px;">⚠️ All IXP Manager users should upgrade to v7.3.0.</div><div style="margin: 0px;"><br /></div><div style="margin: 0px;"><br /></div><div style="margin: 0px;"><br /></div><div style="margin: 0px;"><u><b>Our Continuing Security Commitment & EU CRA Alignment</b><br /></u><br />As IXP Manager powers critical internet infrastructure globally, security is core to our processes, and this is <i><b>the fourth successive release</b></i> primarily focused on security. We have also used third-party reporting as a catalyst to perform proactive internal audits of our codebase, leading to the discovery and immediate mitigation of additional vulnerabilities.<br /><br />Also, with the European Union’s Cyber Resilience Act mandatory reporting requirements taking effect this September, INEX is cognisant of our legal role as an Open-Source Software Steward. To meet these obligations, we have reviewed and updated our <a href="https://github.com/inex/IXP-Manager/security/policy">Security Policy</a>. <br /></div><div style="margin: 0px;"><br /></div><div style="margin: 0px;"><br /></div><div style="margin: 0px;"><b><u>Security Advisory: Vulnerabilities Resolved in v7.3.0</u></b></div><div style="margin: 0px;"><br /></div><div style="margin: 0px;"><b>Impact:</b> High (Privilege Escalation & Unauthorised Access)<br /><br /><ol style="list-style-type: decimal;"><li><span>Privilege Escalation (CVE pending</span><span>) (Severity: 8.8/10) - a</span><span> confirmed vulnerability allows an authenticated, non-administrative user to elevate their privileges to administrator status. This was responsibly disclosed</span><span>.</span></li><li><span>Broken Object-Level Authorisation (CVE pending) </span><span>(Severity: 8.3/10) - f</span><span>ollowing the initial report of (1) above, our development team conducted a proactive internal audit. During this review, we identified and corrected an issue in which an authenticated user could view and edit a resource belonging to another user without authorisation.</span></li></ol><b>Remediation:</b> Both issues are addressed in this v7.3.0 release. Please upgrade to v7.3.0 as soon as possible.<br /></div><div style="margin: 0px;"><br /></div><div style=""><br /></div>
<div style="margin: 0px;"><br /></div><div id="signature_old" style="clear: both; margin: 0px;"><br />
Kind regards,
<br />
Barry O'Donovan
<br />
INEX</div><div id="signature_old" style="clear: both; margin: 0px;"></div></div></div><div><br /></div>
<div><br /></div><div id="signature_old">
<br />
</div><div><br /></div></body></html>