Sallain at 19:16, 20 May 2020

2020-05-20T19:16:57Z

Sallain: Created page with "Home > Release Notes > Archivematica 1.9.3 '''Release date: 20 May 2020''' This release fixes a critical security issue found in the Archivem..."

2020-05-20T19:05:10Z

Created page with "Home > Release Notes > Archivematica 1.9.3 '''Release date: 20 May 2020''' This release fixes a critical security issue found in the Archivem..."

New page

[[Main_Page|Home]] > [[Release_Notes|Release Notes]] > Archivematica 1.9.3

'''Release date: 20 May 2020'''

This release fixes a critical security issue found in the Archivematica dashboard that allows unauthorized users to access some parts of the Administration tab.

This issue was discovered as a result of a security audit by Scholars Portal. It was not discovered as a result of a breach. Scholars Portal reported the issue to Artefactual privately via email. Once we became aware of the issue, we began to develop the fix. Artefactual has also implemented security reporting process documentation across Archivematica-related GitHub repositories and changed issue templates to reflect a more secure process. You can review Archivematica’s security reporting process here: https://github.com/artefactual/archivematica/security/policy.

==Upgrading==

The fix can be easily installed since this issue only affects the dashboard.

CentOS users relying on Archivematica packages should run:

<pre>
sudo yum -y update archivematica-dashboard
sudo systemctl restart archivematica-dashboard
</pre>

Automated installations using Ansible should deploy from our stable branches: stable/1.9.x, stable/1.10.x or stable/1.11.x.

Alternately, a fix can be applied to the web server. The following configuration snippet shows an updated Nginx server block with the additional rule added.

<pre>
server {
listen 80;
client_max_body_size 256M;
server_name _;
location / {
set $upstream_endpoint http://archivematica-dashboard:8000;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
proxy_buffering off;
proxy_read_timeout 172800s;
proxy_pass $upstream_endpoint;
}

# Directive to block access to admin pages in
# Archivematica v1.11.0 or older.
location ~ ^/administration/accounts/login/.+$ {
return 404;
}
}
</pre>

==Fixed==

* [https://github.com/archivematica/Issues/milestone/14 1.11.1 milestone]

@@ Line 45: / Line 45: @@
 </pre>
 ==Fixed==
 * [https://github.com/archivematica/Issues/milestone/14 1.11.1 milestone]

Archivematica 1.9.3 - Revision history

Sallain at 19:16, 20 May 2020

Sallain: Created page with "Home > Release Notes > Archivematica 1.9.3 '''Release date: 20 May 2020''' This release fixes a critical security issue found in the Archivem..."