launchpadblog

We received a private report from a security researcher describing a vulnerability affecting Launchpad. The vulnerability involved the unsafe processing of tar files at build upload and custom upload. We investigated promptly and deployed a fix shortly after the report. The reporting party has confirmed the issue is no longer exploitable.

Following remediation, we completed additional review and monitoring. We found no evidence of malicious exploitation. No user action is required.

We are sharing this update as part of our ongoing commitment to transparency and security.

We thank splitline (@_splitline_) and the DEVCORE Research Team for privately reporting this issue.

Here’s a brief changelog of what we’ve been up to since our last general update.

(more…)

Here’s a brief changelog for this month.

(more…)

Here’s a brief changelog of what we’ve been up to since our last general update.

(more…)

Here’s a brief changelog for this month.

(more…)

Here’s a brief changelog for this month.

(more…)

Once again it’s been a while since we posted a general update, so here’s a changelog-style summary of what we’ve been up to.  As usual, this changelog preserves a reasonable amount of technical detail, but I’ve omitted changes that were purely internal refactoring with no externally-visible effects.

(more…)

Here’s a brief changelog for this month.

(more…)

Well, it’s been a while!  Since we last posted a general update, the Launchpad team has become part of Canonical’s Online Services department, so some of our efforts have gone into other projects.  There’s still plenty happening with Launchpad, though, and here’s a changelog-style summary of what we’ve been up to.

(more…)

Here’s what the Launchpad team did in October.

(more…)