Update 2.16 release notes with 2.16.25 security fixes
Mention 2.16.24 skipped.
Change-Id: Id3001e562d03fea486cf0105ef2c2586a31de0cf
diff --git a/pages/site/releases/2.16.md b/pages/site/releases/2.16.md
index d1c2b99..15bdfeb 100644
--- a/pages/site/releases/2.16.md
+++ b/pages/site/releases/2.16.md
@@ -6,7 +6,8 @@
toc: true
---
-Download: **[2.16.23](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.23.war)**
+Download: **[2.16.25](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.25.war)**
+| [2.16.23](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.23.war)
| [2.16.22](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.22.war)
| [2.16.21](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.21.war)
| [2.16.20](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.20.war)
@@ -31,7 +32,8 @@
| [2.16.1](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.1.war)
| [2.16](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.war)
-Documentation: **[2.16.23](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16.23/index.html)**
+Documentation: **[2.16.25](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16.25/index.html)**
+| [2.16.23](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16.23/index.html)
| [2.16.22](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16.22/index.html)
| [2.16.21](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16.21/index.html)
| [2.16.20](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16.20/index.html)
@@ -636,6 +638,55 @@
## Bugfix Releases
+### 2.16.25
+
+* Security Fixes
+
+ * [Issue 13621](https://bugs.chromium.org/p/gerrit/issues/detail?id=13621):
+ Make `PermissionBackend#ForRef` authoritative.
+
+ Fixes a misconception that leads to data being accessible through Gerrit
+ APIs that should be locked down.
+
+ Gerrit had two components for determining if a Git ref is visible to a
+ user: `(Default)RefFilter` and `PermissionBackend#ForRef` (e.g.,
+ `RefControl`). The former was always capable of providing correct results
+ for all refs. The latter only had logic to decide if a Git ref is visible
+ according to the Gerrit `READ` permissions. This includes all refs under
+ `refs/heads` as well as any other ref that isn't a database ref or a Git
+ tag. This component was unaware of Git tags and database references. Hence,
+ when asked for a database reference such as `refs/changes/xx/yyyyxx/meta`,
+ the logic would allow access if the user has `READ` permissions on any of
+ the ref prefixes (such as the default "read refs/* Anonymous Users").
+
+ That was problematic, because it bypassed
+ [documented behavior](http://gerrit-documentation.storage.googleapis.com/Documentation/2.16.25/access-control.html)
+ where a user should only have access to a change if they can see the
+ destination ref. The same goes for other database references.
+
+ * [Issue 13514](https://bugs.chromium.org/p/gerrit/issues/detail?id=13514):
+ Work around Gitiles bug on `All-Users` visibility.
+
+ Gitiles has a special `FilteredRepository` wrapper that allows carefully
+ hiding refs based on the project's ACLs. There is however an optimization
+ that skips the filtering in case a user has `READ` permissions on every ACL
+ pattern(s). When the target repository is `All-Users`, the optimization
+ turns into a security issue because it allows seeing everything that
+ belongs to everyone, i.e.:
+
+ * draft comments
+ * PII of all users
+ * external ids
+ * draft edits
+
+ This fix now blocks Gitiles or any other part of Gerrit to abuse this power
+ when the target repository is `All-Users`, where nobody can be authorized
+ to skip the ACLs evaluation anyway.
+
+### 2.16.24
+
+This minor release has been withdrawn.
+
### 2.16.23
* NoteDb Migrator Fixes and Improvements
