Evergreen ILS

Open Source Library Software

Downloads

Download files, Git repositories, installation instructions...

Downloads →

Documentation

Official documentation, community wiki, and other resources...

Documentation →

Get Involved

Events, mailing lists, IRC, and more. Join our community!

Community →

Evergreen and OpenSRF Security Releases: Evergreen 3.10.5, 3.11.6, 3.12.4, 3.13.1; OpenSRF 3.2.5 and 3.3.1

The Evergreen Project announces security releases for Evergreen and OpenSRF.

The Evergreen releases are:

  • 3.10.5
  • 3.11.6
  • 3.12.4
  • 3.13.1

The Evergreen releases include fixes for the following issues:

  • Two reflected XSS (cross-site scripting) vulnerabilities that would permit allowing executing arbitrary JavaScript by the user’s web browser
  • An insecure direct object reference (IDOR) vulnerability that allows for constructing URLs that can access arbitrary Action Trigger event output, including data related to patron circulation notices

The IDOR vulnerability is considered critical; all Evergreen sites are recommended to upgrade or apply the fixes as soon as possible.

The OpenSRF releases are:

  • 3.2.5
  • 3.3.1

The OpenSRF releases fix a buffer overflow and a race condition that can crash Perl services. There are no known exploits for either issue, but Evergreen sites are nonetheless recommended to upgrade OpenSRF.

Additional information, including the new releases and release notes with instructions for applying the fixes, can be found on the downloads pages for Evergreen and OpenSRF.

Evergreen Returns to ALA Annual Conference

The Evergreen community is hosting a session this weekend at the American Library Association Annual Conference & Exhibition in San Diego. The session, From User Group to Community: Software for Libraries by Libraries is scheduled for 2:30 to 3:30 p.m. PDT Saturday, June 29, at the Marriott Marquis in the Miramar Room.

Kathy Lussier, Executive Director of the North of Boston Library Exchange (NOBLE) will facilitate the panel discussion, which will include Millissa Macomber (Central Skagit Library District), Jeanette Lundgren (Central and Western Massachusetts Automated Resource Sharing), Galen Charlton (Equinox Open Library Initiative), Elizabeth Thomsen (NOBLE), and Katie Greenleaf Martin (Pennsylvania Integrated Library System). The panel will share examples of how they were able to improve staff workflows and the library user experience with software enhancements realized through the Evergreen open-source software community.
If you are attending ALA, please join us at this program and bring along your friends and colleagues!
#ALAAC24

Evergreen and OpenSRF security releases during the week of June 24

The Evergreen community will release new versions of both OpenSRF and Evergreen during the week of June 24 to fix security vulnerabilities.
Once they are released, all Evergreen sites are encouraged to upgrade immediately.  These releases will be announced on the evergreen-general mailing list and the Evergreen blog once available.
For more information about how security bugs are reported, patched, and released, please see the security wiki page.