6/24/2023 0 Comments Xsection 5.11The following individuals provided tests, code or bug fixes or review to the 5.11 release (in alphabetical order by given name): Andrea Bollini, Andrea Jenis Saroni, Andrew Bennet, Bram Luyten, Hrafn Malmquist, Iordanis Kostelidis, Jonas Van Goolen, Kim Shepherd, Kristof De Langhe, Lotte Hofstede, Luigi Andrea Pascarelli, Mark H. The 5.11 release was led by Alan Orth, Kim Shepherd, Nicholas Woodward and Hrafn Malmquist (of Cottage Labs) View the full list of changes for DSpace 5.11 on GitHub. Avoid crosswalking invalid publish dates for Google Scholar: DS-4104 (#2295).Fix Discovery index command when using the "-c" (clean) option: DS-4393 (#2605).Improve performance of collections endpoints: DS-4342 (#2517).Fix Maven build issue due to blocking of plaintext HTTP repositories: #3247 (see #3274).Fix issue with duplicate headers when bitstream title has a comma: DS-4340 (#2514).Update Sherpa Romeo layout: DS-4377 (#2565).Fix bug in JSPUI Shibboleth session renewal: DS-3444 (#2566).Fix support for custom sitemap.xmap in Mirage 2: DS-3545 (#1691).Fix missing date values while faceting: DS-3791 (#2679).Fix Discovery label for metadata values under authority control: DS-2852 (#1701).Migrate update-sequences.sql script to dspace database command: DS-4167 (#2361).Fix Mirage 2 build broken by disappearance of JRuby gems mirror:.CVE-2022-31192 (impacts JSPUI) : The JSPUI "Request a Copy" feature is vulnerable to Cross Site Scripting (XSS) attacks.Reported by Hassan Bhuiyan, Brunel University London.Both are vulnerable to Cross Site Scripting (XSS). Similarly, the JSPUI autocomplete HTML does not properly escape text passed to it. CVE-2022-31191(impacts JSPUI only) : The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text.When that URL is clicked by the target, it redirects them to a site of the attacker's choice. CVE-2022-31193(impacts JSPUI only) : The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL.This path traversal can only be executed by a user with submitter rights. CVE-2022-31194(impacts JSPUI only) : The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing an attacker to create files/directories anywhere on the server writable by the Tomcat/DSpace user, just by modifying some request parameters during submission.Reported by Johannes Moritz of Ripstech.This path traversal is only possible by a user with special privileges (Administrators or someone with command-line access to the server). This means a malicious SAF (simple archive format) package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. CVE-2022-31195 (impacts XMLUI and JSPUI) : Path traversal vulnerability in Simple Archive Format package import (ItemImportService API). No database changes should be necessary when upgrading from DSpace 5.x to 5.11. As it only provides only security and bug fixes, DSpace 5.11 should constitute an easy upgrade from DSpace 5.x for most users. To ensure your 5.x site is secure, we highly recommend ALL DSpace 5.x users upgrade to DSpace 5.11.ĭSpace 5.11 upgrade instructions are available at: Upgrading DSpaceĭSpace 5.11 is a bug fix release to resolve several issues located in previous 5.x releases. DSpace 5.11 contains security and bug fixes for both the JSPUI and XMLUI.
0 Comments
Leave a Reply. |