2.27.1 was missing a CVE reference link

jodygarnett · jodygarnett · commit 71bc7ec93e60 · 2025-06-10T09:56:44.000-07:00
Inlined the reference to release anouncements to avoid duplicate information
diff --git a/_posts/2024-06-18-geoserver-2-24-4-released.md b/_posts/2024-06-18-geoserver-2-24-4-released.md
@@ -40,6 +40,8 @@ This release addresses security vulnerabilities and is considered an essential u
 * [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost (High)  
   [CVE-2021-40822](https://github.com/geoserver/geoserver/security/advisories/GHSA-68cf-j696-wvv9) SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx (High)
 
+  This duplication is due to CVE-2021-40822 being generated prior to our use of CVE records.
+
 The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts.  See project [security policy](https://github.com/geoserver/geoserver/blob/main/SECURITY.md) for more information on how security vulnerabilities are managed.
 
 ## Demo Requests page rewritten
diff --git a/_posts/2024-06-18-geoserver-2-25-2-released.md b/_posts/2024-06-18-geoserver-2-25-2-released.md
@@ -40,6 +40,8 @@ This release addresses security vulnerabilities and is considered an essential u
 * [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost (* [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost (High)  
   [CVE-2021-40822](https://github.com/geoserver/geoserver/security/advisories/GHSA-68cf-j696-wvv9) SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx (High)
   
+  This duplication is due to CVE-2021-40822 being generated prior to our use of CVE records.
+  
 The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See the project [security policy](https://github.com/geoserver/geoserver/blob/main/SECURITY.md) for more information on how security vulnerabilities are managed.
 
 ## Demo Requests page rewritten
diff --git a/_posts/2025-04-03-geoserver-2-27-0-released.md b/_posts/2025-04-03-geoserver-2-27-0-released.md
@@ -78,6 +78,7 @@ This release addresses several security vulnerabilities, and is a recommended up
 * [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost (Moderate)
 * [CVE-2024-40625](https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2) Coverage REST API Server Side Request Forgery (Moderate)
 
+The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. 
 See project [security policy](https://github.com/geoserver/geoserver/blob/main/SECURITY.md) for more information on how security vulnerabilities are managed.
 
 ## OGC API FeaturesService Extension
diff --git a/_posts/2025-05-13-geoserver-2-25-7-released.md b/_posts/2025-05-13-geoserver-2-25-7-released.md
@@ -30,10 +30,10 @@ Thanks to Jody Garnett and Andrea Aime (GeoSolutions) for making this release.
 
 This release addresses security vulnerabilities and is considered an critical update.
 
-* [CVE-2025-30145](https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf) Denial-of-service (DoS) Vulnerability in Jiffle process (High)
-
 * [CVE-2025-30220](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc) XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service (High)
 
+* [CVE-2025-30145](https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf) Denial-of-service (DoS) Vulnerability in Jiffle process (High)
+
 The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project [security policy](https://github.com/geoserver/geoserver/blob/main/SECURITY.md) for more information on how security vulnerabilities are managed. 
 
 ## Release notes
diff --git a/_posts/2025-05-13-geoserver-2-27-1-released.md b/_posts/2025-05-13-geoserver-2-27-1-released.md
@@ -32,6 +32,8 @@ This release addresses security vulnerabilities and is considered an critical up
 
 * [CVE-2025-30220](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc) XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service (High)
 
+* [CVE-2025-30145](https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf) Denial-of-service (DoS) Vulnerability in Jiffle process (High)  
+
 See project [security policy](https://github.com/geoserver/geoserver/blob/main/SECURITY.md) for more information on how security vulnerabilities are managed. 
 
 ## Define Coverage views using Jiffle expressions
diff --git a/_posts/2025-06-10-cve-disclosure.md b/_posts/2025-06-10-cve-disclosure.md
@@ -10,39 +10,44 @@ categories:
 The GeoServer community has readied the following CVE vulnerabilities for public disclosure.
 
 * [CVE-2025-30220](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc) XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service (High)  
-  Fixed: 2.27.1 | 2.26.3 | 2.25.7
+  Fixed:
+  [GeoServer 2.27.1]({% post_url 2025-05-13-geoserver-2-27-1-released %}) |
+  [GeoServer 2.26.3]({% post_url 2025-05-13-geoserver-2-26-3-released %}) |
+  [GeoServer 2.25.7]({% post_url 2025-05-13-geoserver-2-25-7-released %})
 
 * [CVE-2025-30145](https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf) Denial-of-service (DoS) Vulnerability in Jiffle process (High)  
-  Fixed: 2.27.0 | 2.26.3 | 2.25.7
+  Fixed:
+  [GeoServer 2.27.0]({% post_url 2025-04-03-geoserver-2-27-0-released %}) | |
+  [GeoServer 2.26.3]({% post_url 2025-05-13-geoserver-2-26-3-released %}) |
+  [GeoServer 2.25.7]({% post_url 2025-05-13-geoserver-2-25-7-released %})
   
 * [CVE-2025-27505](https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5) Missing Authorization on REST API Index (Moderate)  
-  Fixed: 2.26.3 | 2.25.6
+  Fixed:
+  [GeoServer 2.26.3]({% post_url 2025-05-13-geoserver-2-26-3-released %}) |
+  [GeoServer 2.25.6]({% post_url 2025-02-17-geoserver-2-25-6-released %})
   
 * [CVE-2024-38524](https://github.com/geoserver/geoserver/security/advisories/GHSA-jm79-7xhw-6f6f) GWC Home Page exposes sensitive server information (Moderate)  
-  Fixed: 2.26.2 | 2.25.6
+  Fixed:
+  [GeoServer 2.26.2]({% post_url 2025-01-27-geoserver-2-26-2-released %}) |
+  [GeoServer 2.25.6]({% post_url 2025-02-17-geoserver-2-25-6-released %})
 
 * [CVE-2024-40625](https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2) Coverage REST API Server Side Request Forgery (Moderate)  
-  Fixed: 2.26.0
+  Fixed:
+  [GeoServer 2.26.0]({% post_url 2024-09-18-geoserver-2-26-0-released %})
 
 * [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost (High)  
   [CVE-2021-40822](https://github.com/geoserver/geoserver/security/advisories/GHSA-68cf-j696-wvv9) SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx (High)  
-  Fixed: 2.25.2 | 2.24.4
+  Fixed:
+  [GeoServer 2.25.2]({% post_url 2024-06-18-geoserver-2-25-2-released %}) |
+  [GeoServer 2.24.4]({% post_url 2024-06-18-geoserver-2-24-4-released %})
   
   This duplication is due to CVE-2021-40822 being generated prior to our use of CVE records.
 
 * [CVE-2024-34711](https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965) Improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) (High)  
-  Fixed: 2.25.0
-
-The following release announcements have been updated:
-
-* [GeoServer 2.27.1]({% post_url 2025-05-13-geoserver-2-27-1-released %})
-* [GeoServer 2.26.3]({% post_url 2025-05-13-geoserver-2-26-3-released %})
-* [GeoServer 2.26.0]({% post_url 2024-09-18-geoserver-2-26-0-released %})
-* [GeoServer 2.25.7]({% post_url 2025-05-13-geoserver-2-25-7-released %})
-* [GeoServer 2.25.6]({% post_url 2025-02-17-geoserver-2-25-6-released %})
-* [GeoServer 2.25.2]({% post_url 2024-06-18-geoserver-2-25-2-released %})
-* [GeoServer 2.24.4]({% post_url 2024-06-18-geoserver-2-24-4-released %})
-* [GeoServer 2.25.0]({% post_url 2024-03-19-geoserver-2-25-0-released %})
+  Fixed:
+  [GeoServer 2.25.0]({% post_url 2024-03-19-geoserver-2-25-0-released %})
+
+The release announcements listed above have been updated.
 
 Free software is a participation sport - to create a patch for a prior release volunteer with [community development](/devel/).
 
