[release/v1.3] Prepare for v1.3.2 (#1749)

* Add qoutes to path. (#1694) * fix pathing * Update changelog --------- Co-authored-by: mattdurham <mattdurham@ppog.org>
grafana · Sep 25, 2024 · 8ce3a6d · 8ce3a6d
1 parent f35cfce
commit 8ce3a6d
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,13 @@ This document contains a historical list of changes between releases. Only
 changes that impact end-user behavior are listed; changes to documentation or
 internal API changes are not present.
 
+v1.3.2
+-----------------
+
+### Security fixes
+
+- Add quotes to windows service path to prevent path interception attack. [CVE-2024-8975](https://grafana.com/security/security-advisories/cve-2024-8975/) (@mattdurham)
+
 v1.3.1
 -----------------
 

diff --git a/packaging/windows/install_script.nsis b/packaging/windows/install_script.nsis
@@ -98,7 +98,7 @@ Section "install"
   Call InitializeRegistry
 
   # Create the service.
-  nsExec::ExecToLog 'sc create "Alloy" start= delayed-auto binpath= "$INSTDIR\alloy-service-windows-amd64.exe"'
+  nsExec::ExecToLog 'sc create "Alloy" start= delayed-auto binpath= "\"$INSTDIR\alloy-service-windows-amd64.exe\""'
   Pop $0
 
   # Start the service.
@@ -156,7 +156,7 @@ Function InitializeRegistry
   nsExec::ExecToLog 'Reg.exe query "${REGKEY}" /reg:64 /ve'
   Pop $0
   ${If} $0 == 1
-    nsExec::ExecToLog 'Reg.exe add "${REGKEY}" /reg:64 /ve /d "$INSTDIR\alloy-windows-amd64.exe"'
+    nsExec::ExecToLog 'Reg.exe add "${REGKEY}" /reg:64 /ve /d  "\"$INSTDIR\alloy-windows-amd64.exe\""'
     Pop $0 # Ignore return result
   ${EndIf}