by On behalf of the Evergreen contributors, the 2.7.x release maintainer (Ben Shum) and the 2.6.x and 2.5.x release maintainer (Dan Wells), we are pleased to announce the release of Evergreen 2.7.4, 2.6.7, and 2.5.9.
The new releases can be downloaded from:
http://evergreen-ils.org/egdownloads/
THESE RELEASES CONTAIN SECURITY UPDATES, so you will want to upgrade as soon as possible.
In particular, the following security issues are fixed:
- Bug 1424755: This bug allows unauthorized remote access to the value of certain library settings that are meant to be confidential.
- Bug 1206589: This bug allows unauthorized remote access to the log of changes to library settings, including ones meant to be confidential.
All prior supported releases are vulnerable to these bugs.
All three of these new releases also contain bugfixes that not related to the security issues. For more information on the changes in these releases, please consult their change logs:
Please note that 2.5.9 is the last release expected in the 2.5.x series.
It is recommended that all Evergreen sites upgrade to one of the new releases as soon as possible.
If you cannot do a full upgrade at this time, it is extremely important that that you patch your Evergreen system to protect against these exploits. To that end, two patches are available, one for bug 1424755 and one for bug 1206589, that you can download and apply to a running system.
In order to secure your system, you must download the two patches and copy them to each of your Evergreen servers — in particular, any that run the open-ils.actor and/or open-ils.pcrud services. You will need to perform the following steps on each server to completely patch your system.
First, you must find where the Actor.pm module is located. This is usually under /usr/local somewhere. The following command will find it for you:
find /usr/local -name Actor.pm
On an Ubuntu 12.04 system, the above prints out /usr/local/share/perl/5.14.2/OpenILS/Application/Actor.pm so we will use that as our example, just be sure that when you do this for real, you use the actual path printed by the above command. If it prints nothing, you will need to check other locations.
Once you have the path, you can run the patch command. Assuming that you are in the directory where you put the patch file, the following command should apply the patch:
sudo patch -b /usr/local/share/perl/5.14.2/OpenILS/Application/Actor.pm lp1424755.patch
Unless you have made local edits to the affected file, the patch should apply cleanly.
Next, you will need to apply the patch for bug 1206589. This can be done as the opensrf user:
patch -b /openils/conf/fm_IDL.xml lp1206589.patch
After you have applied the patches, you will need to restart the open-ils.actor and open-ils.pcrud services. You do this by running osrf_control with the appropriate options:
osrf_control [--localhost] --restart --service open-ils.actor osrf_control [--localhost] --restart --service open-ils.pcrud
The --localhost is in brackets because you may or may not need it. Your system administrator should know if you do or not. If you do need it, remove the brackets. If you don’t need it, then omit the option entirely.