Evergreen ILS

Open Source Library Software

Jason Stephenson

Security Releases: Evergreen 3.4.6, 3.5.3, and 3.6.2

On behalf of the Evergreen contributors, we are pleased to announce the release of Evergreen 3.4.6, 3.5.3, and 3.6.2.

Theys are available from the downloads page.

THESE RELEASES CONTAIN A SECURITY UPDATE.

It is recommended that all Evergreen sites upgrade as soon as possible.

These releases fix a potential crash of a back end service when requests are made with a null authorization token.

All of these new releases contain additional bug fixes that not related to the security issue. For more information on the changes in these releases, please consult their release notes:

Evergreen 3.4.5, 3.5.2, and 3.6.1 Released

The Evergreen release team is pleased to announce the availability of maintenance releases
3.4.5, 3.5.2, and 3.6.1. These releases include contributions from 19 individuals from 13
organizations: a true team effort. Changelog and release notes, along with the releases
themselves are available on the Evergreen Downloads page.

Many of these code and documentation improvements are the products of the Evergreen Hack-A-Way, which met online
during the last week of October and had broad participation across the community. The fixes and features
span across all areas of usage, including circulation, cataloging, administration, acquisitions and the public catalog.

This marks the final point release of the 3.4 series, which will continue to receive security fixes over the next three months.
Sites are encouraged to plan upgrades to 3.5 or 3.6 as soon as they can manage.

Security Releases: Evergreen 3.1.15, 3.2.9, 3.3.4, and 3.4-beta2

On behalf of the Evergreen contributors, we are pleased to announce the release of Evergreen 3.1.15, 3.2.9, 3.3.4, and 3.4-beta2.

The new releases can be downloaded from:

http://evergreen-ils.org/egdownloads/

THESE RELEASES CONTAIN SECURITY UPDATES.

It is recommended that all Evergreen sites upgrade to one of the new releases as soon as possible.

These releases fix two bugs related to cross-site scripting (XSS) vulnerabilities in the public catalog.

Bug 1559239: Mitigates a potential risk of having a web page location changed when opening a link in a new tab. Evergreen administrators should review whether the following templates have been customized or overridden. If so, either the template should be replaced with the stock version or the rel="noopener" attribute added to all anchor (<a/>) tags with a target="_blank" attribute.

  • Open-ILS/src/templates/opac/parts/record/summary.tt2
  • Open-ILS/src/templates/opac/parts/result/table.tt2

Bug 1822630: Resolves a problem with not properly sanitizing user input. When upgrading, Evergreen administrators should review whether any of the following templates have been customized or overridden. If so, either the template should be replaced with the stock version or the XSS fix (which entails adding the | html filter in several places) applied to the customized version.

  • Open-ILS/src/templates/opac/browse.tt2
  • Open-ILS/src/templates/opac/parts/ebook_api/base_js.tt2
  • Open-ILS/src/templates/opac/parts/header.tt2
  • Open-ILS/src/templates/opac/parts/place_hold.tt2
  • Open-ILS/src/templates/opac/parts/place_hold_result.tt2
  • Open-ILS/src/templates/opac/parts/result/adv_filter.tt2

All of these new releases also contain bugfixes that not related to the security issues. For more information on the changes in these releases, please consult their release notes: