Hello all,

Today we've released bugfix updates to our current stable branch 3.4 and the previous stable branch 3.3.

Most notably, these contain a fix for a security issue: the compilation phase was not run under an unprivileged user, which allows (in some languages) a contestant to insert compile-time instructions, e.g. to try to access locally stored test data, see tests/test-compile-read-testcase.hs for proof of concept code. This is fixed by running the compile phase also under the unprivileged 'domjudge-run' user, and making sure that this user does not have access to any testcase or other judging data. Note that especially in the 3.3 branch this introduces a significant amount of code that had to be backported from the stable 3.4 and master branches. In the new 4.0 series release we are working towards running the compile phase completely within a chroot environment, just as the run phase.

A number of smaller issues have also been fixed. See the ChangeLog file for details.

Downloads as usual through our home page: http://www.domjudge.org/download

On behalf of the DOMjudge developers, Jaap Eldering

_______________________________________________ DOMjudge-announce mailing list Unsubscribe via: https://www.a-eskwadraat.nl/mailman/listinfo/domjudge-announce