Mapping between versions?

[Balzu]

Hello everyone!
I saw that versions below or equal to 2.3m are affected by CVE-2024-23692, while version 3 is not affected.

However, I see that the latest stable release is 0.52.10, so my question is: is there a mapping between release numbers and HFS versions? Because I see that in certain cases HFS shows2.x as server version while in others it shows 0.x as version, so it is not clear to me which is the actual version.

Thanks for the clarification!!!

[rejetto]

right, it's quite unclear.
HFS 3 is not considered "complete" until the whole feature set offered by HFS 2 is covered. Until then, i'm using versions 0.xx, that means that version 3 is in preparation.
So 0.52 is actually HFS 3, as it is now.
When i'll be done with all the features i'll release version 3.0.0, and this is expected before the year ends.

version 2.4 is also affected by the bug.

[rejetto]

i see you are into security research.
Are you giving a close look at hfs3 in this aspect?
i really hope so :)

[Balzu]

Thank you so much for the clarification!
This CVE indeed gained more attention after CISA elevated it to KEV

[rejetto]

let me know if i can help you with further studies