with

4.6.0

cut, when will it be available via package manager? The site still shows

4.5.1

as being the latest.

We usually upload packages here after a tag is made; we then wait ~a week and if everything is good it becomes a stable release

ok, so if we wanted to remediate the security vuln via package manager we'll wait until i'ts marked stable?

Yes. Or build your own. Or filter it at a central point.

I was confused by that, “filter it at a central point”, is “it” the new version?

I believe seph means filter within the tool you use to run distributed queries.

Ah no, that's not something we have enabled here. It seems to me that the exposure here is through

distributed

endpoints, so if someone had access to a box w/ osquery on it, the most they could do is write to files on that box?

theopolis did intuit what I meant 🙂

Thank you 😄

The exposure is that someone who has administrative access (either via the schedule or the distributed interface) can write arbitrary sqlite files. If you don’t have any kind of central osquery control I don’t see how you have any risk exposure

...someone who has administrative access...

that reads to me someone whose on a box running

sudo osqueryi

and writing arbitrary sqlite files to disk. Which could also be done via any fleet manager that has

distributed

enabled?

yes to both of those.

Got, just making sure I understand the risk here 😄 Thanks!