<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Dear IPT users,</div><br>This is an important message regarding the IPT. <br><br>IPT administrators should update their IPTs to the new version (2.1.1) which has a security update and is available for download <a href="http://repository.gbif.org/content/groups/gbif/org/gbif/ipt/2.1.1/ipt-2.1.1.war">here</a>. <div><div><br>The security update fixes a couple vulnerabilities inherited from the Apache Struts web framework, which the IPT uses. Struts made <a href="http://struts.apache.org/announce.html#a20140424">this announcement</a> describing their latest release and its patched security issues that the IPT has upgraded to.</div><div><br></div><div>For further information about the Struts vulnerabilities, as well as some helpful mitigation strategies for server administrators, you can refer to <a href="http://www.symantec.com/connect/blogs/emerging-threat-apache-struts-zero-day-cve-2014-0050-0094-dos-and-remote-code-execution-vulner">this article</a>. <br><br>Simple instructions on how to update your IPT are below. If you don't have time to update your IPT immediately, I would advise you to take it offline until you can.</div><div><div><br></div><div>Please email the IPT list directly for more help upgrading your installation.<br><br>Sincerely,<br><br>Kyle, on behalf of the IPT development team and the GBIF Secretariat</div><div><br>Instructions how to update IPT in Tomcat:<br><div><ol><li>Please download: <a href="http://repository.gbif.org/content/groups/gbif/org/gbif/ipt/2.1.1/ipt-2.1.1.war">http://repository.gbif.org/content/groups/gbif/org/gbif/ipt/2.1.1/ipt-2.1.1.war</a></li><li>Backup IPT data directory somewhere safe</li><li>Remove ipt.war from $tomcat/webapps/ (some seconds later, the deployed /ipt folder should automatically delete)</li><li>Once ipt.war and /ipt have been removed from /webapps - stop Tomcat</li><li>Add new version to /webapps renaming it from ipt-2.1.1.war to ipt.war</li><li>Start Tomcat</li><li>In a browser open the application (if it doesn't appear at first, try restarting Tomcat once more).</li><li>When prompted for IPT data directory, enter same location as existing IPT data directory </li><li>Press continue, hopefully installation succeeds.</li></ol></div></div></div></div></body></html>