Disclosure of Replay Attack Vulnerability in Signed References

As announced in the release notes for Radicle 1.7.0 , that version contains a fix for a security vulnerability. Radicle 1.7.1 , and Radicle 1.8.0 , which were released since, also contain this fix. We did not disclose the vulnerability at the time of releasing Radicle 1.7.0 in order to give users time to upgrade, before we disclose the security vulnerability in detail, which is the purpose of this post.