Upgrade your Metabase instance NOW

News and Announcements
1

Hi there, we identified a very severe issue recently which allows unprivileged access to any Metabase instance. This issue affects any Metabase server v43.x+

We'll release the details once we can ensure that most of our users are patched, but we'll need everyone to patch (upgrade to the latest possible minor version in their current major version) their Metabase instances as soon as possible. E.g: if you're running v46, upgrade to v46.6.1, if you're running v45, upgrade to v45.4.1

Please consider this is a very severe issue, you really need to upgrade if you're running an unpatched version

5 Likes
4

Hi @Luiggi , I don't find any security fixes in the difference between v0.46.6 and v0.46.6.1, which specific commit actually contains the security fix?

1 Like
5

if you're running a fork please send us a message to help at metabase dot com. We're not commiting the code till we're sure that some decent amont of time has passed to make sure most users can patch their instances

6

What's the status for versions v0.42.x and earlier? Are you considering them still active or not?

7

The AWS EB Downloads for the 0.43.7.2, 0.44.7.1, and 0.45.4.1 are missing from downloads.metabase.com!

Only 0.46.6.1 is on downloads.metabase.com.

Thus I am unable to upgrade our AWS EBS instance to the latest 0.45.x (not ready to upgrade to 0.46 yet until we test it since the last attempt caused serious issues)

8

there's no impact in v42 at all, but please consider upgrading because you're missing the latest features/bug fixes

9

please use the following guide for upgrading Beanstalk, as we haven't done a "normal" release this time so you'll need to build a beanstalk artifact on your own (it's just changing a line)

10

Thanks.

11

Didn't find any related changes on v0.46.1, it's the same as v0.46.0
I got a security patch with some file changes from the reply on my submitted ticket earlier today. There're some changes that I can patch to the codebase. But with these changes, now I cannot log in to my account. Get such error:

ERROR: column core_user.google_auth does not exist Position: 204
1 Like
12

46.0 and 46.1 don't include the patch, in fact both are old versions. I would suggest you upgrade to the latest version of 46 and then apply the patch.

Also, teh issue you're seeing is because you downgraded to v45 which is not supported. Your DB is now in version 46 while you're running v45 code

13

Actually, I mean for v0.46.6.0 and v0.46.6.1, which is the version released earlier today.
I didn't see the file patchces to be included in v0.46.6.1 version source code.

14

Considering its Friday, lets make sure to wait at least a little while into the next work week before releasing patch notes. Even if most people have upgraded, there's a good chance some orgs cant accommodate an upgrade right before the weekend. Lets not make sitting ducks out of them :frowning:

15

we won't release any notes about the issue till a good time has passed, don't worry, please focus on upgrading and if possible help people on the forum who're struggling with it. There are > 50K instances of Metabase around the world that need to be patched

16

Is there any Metabase(opensource) guide available for an easy upgrade when running on Heroku?

17

you simply need to grab the buildpack you used for deploying it and upgrade the version there

18

I came across this document in previous threads, but it appears to be broken: https://www.metabase.com/docs/latest/operations-guide/running-metabase-on-heroku.html#deploying-new-versions-of-metabase.

I found it in this discussion: Update metabase when installed on Heroku.

Is there a new working link available that can provide information on what steps I need to take

19

@antoniott15 the discussion in Support for Heroku just helped us migrate from buildpacks on Heroku to containers on Heroku, which let us upgrade from v45.x to v46.x. upgrade - Switch to Docker-based deployment of Metabase (>=v0.46) on Heroku - Stack Overflow may also be helpful.

20

@Luiggi What would be the best way to automatically inform ourselves, as open source users, with future security issues? We now figured out by seeing the blog.

21

@Luiggi is there any news for the upcomming new version?
I have like 20+ Metabase instances to update, who are all on local networks, so not reachable from outside, and i'm not looking forward to update them all now when you would release v0.47 next week :slight_smile:

22

Couple of weeks :slight_smile: