March 2017 - IPT - lists.gbif.org

IPT upgrade
by Julien Cigar 21 Mar '17

21 Mar '17

Hello, We have a bunch of IPT's installed here and in order to automate IPT upgrades I'd like to know if it's enough to just create the missing $ROOT/WEB-INF/datadir.location once the WAR has been updated? I'm asking this because I have 8 IPT instances and it becomes tedious (and I'm lazy) to go through all th 8 web interfaces just to enter the IPT datadir on every upgrade .. Thanks! Julien -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced.

3 3

IPT new version 2.3.4
by CALDENTEY Marta 15 Mar '17

15 Mar '17

Dear Kyle, We have tried to upgrade our UAT environment and we get the following error. We also tried to request to https://gbrds.gbif-uat.org but we have no answer. Is this environment working? Kind regards, Marta [cid:image001.png@01D29C11.CFCC1040] Ing. Marta B. Caldentey Direccion de Sistemas de Informacion Mincyt Int 1014

10 15

New version 2.3.4 with security update
by Kyle Braak 11 Mar '17

11 Mar '17

Dear IPT users, This is an important message. IPT administrators should update their IPTs to the new version 2.3.4 available for download here<http://repository.gbif.org/content/groups/gbif/org/gbif/ipt/2.3.4/ipt-2.3.4…> [1], which has a security update. Note this version requires Java8 to run and instructions on how to upgrade to this version can be found in the Release Notes<https://github.com/gbif/ipt/wiki/IPTReleaseNotes233.wiki> [2]. The security update fixes a critical vulnerability<https://struts.apache.org/docs/s2-045.html> [3] that has been discovered in the Apache Struts web framework, which the IPT uses. According to this article<http://thehackernews.com/2017/03/apache-struts-framework.html> [4], this is a remote code execution vulnerability that could allow hackers to execute malicious commands on the IPT server. It also says that hackers are actively exploiting this vulnerability. If you don't have time to update your IPT immediately, I would advise you to take it offline until you can. Sincerely, Kyle Braak IPT Product Manager GBIF Secretariat [1] http://repository.gbif.org/content/groups/gbif/org/gbif/ipt/2.3.4/ipt-2.3.4… [2] https://github.com/gbif/ipt/wiki/IPTReleaseNotes233.wiki [3] https://struts.apache.org/docs/s2-045.html [4] http://thehackernews.com/2017/03/apache-struts-framework.html

1 0