AtoM broken after PHP upgrade for CVE-2019-11043

[mpw...@ualberta.ca]

Greetings,

AtoM 2.4.1

Ubuntu 16.04

Nginx 1.10.3

PHP 7.0.33

MySQL 5.7

This site has been working fine since 2015 (created as AtoM 2.1.0), until this upgrade.

The subject says it: After upgrading PHP as per CVE-2019-11043, AtoM is broken, all you get is a 504 gateway timeout from nginx. The error log is full of this, over & over:

2019/11/05 23:27:59 [error] 1289#1289: *24 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Uncaught Error: Class 'QubitWebResponse' not found in /var/www/atom/cache/qubit/prod/config/config_factories.yml.php:70

Stack trace:

#0 /var/www/atom/vendor/symfony/lib/util/sfContext.class.php(155): require()

#1 /var/www/atom/vendor/symfony/lib/util/sfContext.class.php(77): sfContext->loadFactories()

#2 /var/www/atom/vendor/symfony/lib/util/sfContext.class.php(60): sfContext->initialize(Object(qubitConfiguration))

#3 /var/www/atom/index.php(6): sfContext::createInstance(Object(qubitConfiguration))

#4 {main}

  thrown in /var/www/atom/cache/qubit/prod/config/config_factories.yml.php on line 70" while reading response header from upstream, client: 12.34.56.78, server: atomserver.ca, request: "GET /index.php/informationobject/browse?names=851&view=card&subjects=39678&sort=alphabetic HTTP/1.0", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "atomserver.ca"

What I have tried:

Restored the site + database from a time before the PHP upgrade - it made no difference, same error.

Remove (apt purge) PHP and re-install - it made no difference, same error.

Install a new, blank AtoM 2.5.2 site - same error; you can't even *start* the install process.

Install a new, blank AtoM 2.4.1 site - ditto.

Any ideas, anyone? Any and all help much appreciated.

[David Juhasz]

Hi there,

This looks to me like an application caching error.  The listed file "/var/www/atom/cache/qubit/prod/config/config_factories.yml.php" is a cached version of the "config/factories.yml" file.  The missing class "QubitWebResponse" was added in AtoM 2.5.0 so I think you have a cached version of the 2.5.0 factories.yml file in your AtoM install.

There's a couple of ways to clear the application cache in AtoM, but the most reliable way is to delete everything in the atom/cache/ directory, i.e.

sudo rm -Rf /var/www/atom/cache/*

Once you've deleted the cache, I would restart php-fpm and memcached (if installed) and try loading AtoM in a browser.  If you are still having problems after clearing the caches, then I would make sure the code files are in a consistent state (e.g. all 2.4.1 or all 2.5.3) and post here if you still having problems.

If deleting the cache works, then make sure you also restart the job scheduler (daemon) to make sure it's in sync with the website.

I hope that helps!

David

--

David Juhasz
Senior Developer

Artefactual Systems Inc.
www.artefactual.com

--
You received this message because you are subscribed to the Google Groups "AtoM Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ica-atom-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ica-atom-users/a0d999e8-bbb6-40d1-b5af-abb1b1adab20%40googlegroups.com.

[Michael Ward]

YAY! 

That worked!

I deleted everything in the cache folder manually and rebooted, after which php7.0-fpm refused to start. But, doing 

php symfony jobs:clear

...fixed that.

THANK YOU.

You received this message because you are subscribed to a topic in the Google Groups "AtoM Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/ica-atom-users/dXf36jPEP64/unsubscribe.
To unsubscribe from this group and all its topics, send an email to ica-atom-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ica-atom-users/CABMx%3DejcTvp%2BDHjwSJzDqMxSgQBmSDH58N5w8FC8Ve24Ko3%3DgA%40mail.gmail.com.

--

Michael Ward

Arts Resource Centre (ARC)

450 Arts, University of Alberta, Edmonton, Alberta, T6G 2E6

780-492-5278

[David Juhasz]

YAY!  I'm glad that worked for you Michael. :D  And thanks for letting us know.

--

David Juhasz
Senior Developer

Artefactual Systems Inc.
www.artefactual.com

To view this discussion on the web visit https://groups.google.com/d/msgid/ica-atom-users/CAAUb%2B1oNZSD-ZY%2BD4hsC%3DK4k%3DZKUGuf1fhp5VPnyA%3DERodBL%3DQ%40mail.gmail.com.