Sarah Mason
Hi AtoM Community,
As per our forum notification from last week, Artefactual is announcing the release of the security patch and installation instructions.
The issue:
AtoM versions 2.5 to 2.10 contain an access-control issue affecting one or more unauthenticated endpoints. Under specific conditions, an unauthenticated user could access limited user-account metadata (specifically: usernames, email addresses, and user role). It is also possible under specific conditions to access the title of draft archival descriptions.
We are not aware of any exploitation of this vulnerability. The issue does not expose passwords, authentication tokens, any other private metadata in archival descriptions (other than title of draft records noted above), or uploaded files.
How to apply the fix:
Download the patch file from: https://gist.github.com/qubot/b7875f864acb41bd39890f701e66c4a5
From within the AtoM folder, run the following commands as AtoM or nginx user to apply the patch:
git apply /path/to/patch/file/security_yml.patch
Or alternatively, if you installed AtoM from the tarball, and do not use git, run:
patch -p 1 < /path/to/patch/file/security_yml.patch
Note that users of AtoM 2.7.x and above should use the security_yml.patch, and users of AtoM 2.5.x and 2.6.x should use 2.5-security_yml.patch.
After the patch is applied, to clear the cache so that the changes take affect, run:
php symfony cc
systemctl restart php8.1-fpm.service (use the php version that is installed if not using php 8.1)
systemctl restart memcached.service
After applying the security fix, there is a minor change affecting advanced search functionality for unauthenticated users. For users who are not logged in, ‘typeahead’ for the top-level descriptions field in Advanced Search for Information Objects will no longer function. A future release of AtoM will include a fix for this issue in the code, at which point the patch described here can be removed.
If you have any questions, please do not hesitate to contact me or the Community Team at contri...@artefactual.com.
Best wishes,
Sarah
Sarah Mason
Contributor Success Specialist
Artefactual Systems Inc.
she/her
Roberto Greiner
Hi,
I'm trying to apply the patch using the tarball option, but after running the 'patch' command, nothing happens. The command simply hangs, not proceeding, no error, no message, nothing. Simply does not complete. After 10 minutes, the command still didn't finish. I tried running the command again with the --verbose option, but still nothing at all. Should I open the diff file and apply the changes manually, since they ate relatively small and simple? Something else?
I've downloaded the file from https://gist.githubusercontent.com/qubot/b7875f864acb41bd39890f701e66c4a5/raw/f1eaede31e45e966c4d9a3666c8b6e0b20565001/security_yml.patch, and am running Atom 2.10.1 v197 on an Ubuntu 24.04.01 install.
Thank you,
Roberto Greiner
--
You received this message because you are subscribed to the Google Groups "AtoM Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ica-atom-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ica-atom-users/ba3b4d6e-9025-449a-9706-325e355b6091n%40googlegroups.com.
--
-----------------------------------------------------
Marcos Roberto Greiner
Os otimistas acham que estamos no melhor dos mundos
Os pessimistas tem medo de que isto seja verdade
James Branch Cabell
-----------------------------------------------------
pieters...@gmail.com
Hi Roberto,
That silent hang - nothing at all, even with --verbose - is the giveaway: patch never reached the diff, it's sitting there waiting for input from the terminal.
It means the "< security_yml.patch" redirect isn't feeding the file to patch (usually a stray character from copy-paste, or the file isn't where the redirect is pointing). If patch had received the file it would either print hunk
output or fail immediately - it wouldn't just sit silently.
Two things to try:
1) Read the patch from the file directly with -i instead of the "<" redirect, and preview with --dry-run first. Run this from your AtoM root (the folder that contains apps/, lib/, plugins/):
patch -p1 --dry-run --verbose -i /full/path/to/security_yml.patch
If the dry run shows the hunks applying, run it again without --dry-run to apply for real.
2) Two quick sanity checks:
- "head -3 security_yml.patch" should start with "diff --git a/apps/qubit/config/security.yml". If instead you see "<!DOCTYPE html>", you saved the gist web page rather than the raw file - re-download the raw one:
wget -O security_yml.patch https://gist.githubusercontent.com/qubot/b7875f864acb41bd39890f701e66c4a5/raw/f1eaede31e45e966c4d9a3666c8b6e0b20565001/security_yml.patch
- Make sure you run it from the AtoM root; -p1 strips the leading "a/" from the paths, so from the wrong directory patch prompts "File to patch:" and waits (another silent hang).
You're right that applying it by hand is easy - it's only five small security.yml edits (mind the 2-space YAML indentation). From the AtoM root:
1. apps/qubit/config/security.yml - add:
autocomplete:
credentials: [[ editor, administrator ]]
is_secure: true
2. apps/qubit/modules/actor/config/security.yml - this file doesn't exist yet;
create it with:
autocomplete:
is_secure: false
3. apps/qubit/modules/search/config/security.yml - add:
autocomplete:
is_secure: false
4. apps/qubit/modules/taxonomy/config/security.yml - change the existing
autocomplete block's is_secure from false to true:
autocomplete:
is_secure: true
5. apps/qubit/modules/user/config/security.yml - add:
autocomplete:
credentials: administrator
Then clear the cache and restart. Note that Ubuntu 24.04 ships PHP 8.3, so use php8.3-fpm rather than 8.1:
php symfony cc
sudo systemctl restart php8.3-fpm.service
sudo systemctl restart memcached.service
Groete / Regards
Johan Pieterse
082 337-1406
To view this discussion visit https://groups.google.com/d/msgid/ica-atom-users/a239c283-c683-4550-9079-f7f0f49fe084%40gmail.com.
Roberto Greiner
Argh.... I'm feeling so stupid right now.....
Somehow, when I pasted the command, the '<' was gone, so I was only doing "patch -p 1 security_yml.patch". Of course it didn't work. Typed correctly it worked immediately.
Tks and Sorry....
To view this discussion visit https://groups.google.com/d/msgid/ica-atom-users/002401dd1dda%24873a8be0%2495afa3a0%24%40gmail.com.