Contribute to the DSpace Development Fund

The newly established DSpace Development Fund supports the development of new features prioritized by DSpace Governance. For a list of planned features see the fund wiki page.

Support for DSpace 6 will be ending on July 1, 2023.  See Support for DSpace 5 and 6 is ending in 2023

DSpace 6.4 was officially released to the public on July 28, 2022

DSpace 6.4 can be downloaded immediately from:

More information on the 6.3 release (and the 6.x platform in general) can be found in the 6.x Release Notes.

Upgrade instructions can be found at Upgrading DSpace

We highly recommend ALL users of DSpace 6.x upgrade to 6.4

DSpace 6.4 contains security fixes for both the JSPUI and XMLUI. To ensure your 6.x  site is secure, we highly recommend ALL DSpace 6.x users upgrade to DSpace 6.4l.

DSpace 6.4 upgrade instructions are available at: Upgrading DSpace

Security fixes include:

  • [HIGH] CVE-2022-31195 (impacts XMLUI and JSPUI): Path traversal vulnerability in Simple Archive Format package import (ItemImportService API). This means a malicious SAF (simple archive format) package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. This path traversal is only possible by a user with special privileges (Administrators or someone with command-line access to the server).
    • Reported by Johannes Moritz of Ripstech
  • [HIGH] CVE-2022-31194 (impacts JSPUI only) : The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing an attacker to create files/directories anywhere on the server writable by the Tomcat/DSpace user, just by modifying some request parameters during submission. This path traversal can only be executed by a user with submitter rights.
    • Reported by Johannes Moritz of Ripstech
  • [HIGH] CVE-2022-31193 (impacts JSPUI only) : The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice.
    • Reported by Johannes Moritz of Ripstech
  • [MODERATE] CVE-2022-31191 (impacts JSPUI only) : The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not properly escape text passed to it. Both are vulnerable to Cross Site Scripting (XSS).
    • Reported by Hassan Bhuiyan, Brunel University London
  • [MODERATE] CVE-2022-31192 (impacts JSPUI only) : The JSPUI "Request a Copy" feature is vulnerable to Cross Site Scripting (XSS) attacks.
    • Reported by Andrea Bollini of 4Science
  • [LOW] CVE-2022-31189 (impacts JSPUI only) When an "Internal System Error" occurs in the JSPUI, then entire exception (including stack trace) is available. Information in this stacktrace may be useful to an attacker in launching a more sophisticated attack.
    • Reported by Johannes Moritz of Ripstech
  • [LOW] CVE-2022-31190 (impacts XMLUI only) Metadata of withdrawn Items is exposed to anonymous users in XMLUI.
    • Reported by David Cavrenne of Atmire

Major bug fixes include:

Minor improvements include:

  • Limit the usage of PDFBoxThumbnail media filter to PDFs: DS-3873
  • Update PDFBox version: #2742
  • Update spider user agent file for more accurate Solr usage statistics: DS-4587 (#3333)
  • Update JavaScript dependencies: DS-4508 (#2918)
  • Remove non-existent command from OAI's CLI help: DS-4260 (#2439)
  • Fix Discovery index command when using the "-c" (clean) option: DS-4393 (#2606)
  • Fix issue with bulkedit.ignore-on-export parameter on DSpaceCSV: #2661
  • Improve dspace structure-builder  error messages: DS-4087 (#2681)
  • Remove GeoIP download Ant target, reconfigure for external provision: DS-4409 (#2652)
  • Restores getSize() in Bitstream for replication task suite: DS-3895 (#2683)
  • Remove unnecessary second Context in RDFConsumer: #8152
  • Fix minor security issue with HTML links using target="_blank": DS-3891 (#7238)
  • Correctly remove Handle server lock file: DS-3946 (#2114)
  • Make automatic Discovery re-indexing configurable: DS-3658 (#2184)
  • Allow configuring max results per page in search: DS-4120 (#2306)
  • Improve OAI performance for large installs: DS-4136 (#2320)
  • Avoid crosswalking invalid publish dates for Google Scholar: DS-4104 (#2294)
  • Bitstreams should keep their formats when being versioned: DS-4078 (#2261)
  • Only execute ImageMagick identify on the first page of PDF: DS-3664 (#2201)
  • Allow OAI Harvester to continue if it encounters an Item missing a handle: DS-3939 (#2106)
    • Note: the OAI Harvester Consumer has been completely removed from the DSpace codebase and should be removed from any configuration files referencing it: DS-4129 (#2314).

View the full list of changes for DSpace 6.4 on GitHub.

6.4 Acknowledgments

The 6.4 release was led by Alan Orth, Kim Shepherd, Nicholas Woodward and Hrafn Malmquist (of Cottage Labs).

The following individuals provided tests, code, bug fixes, or review to the 6.4 release (in alphabetical order by given name): Alan Orth, Alexander Sulfrian, Andrea Bollini, Andrea Jenis Saroni, Andrew Wood, Anis, Bram Luyten, Chris Herron, Chris Wilper, Cornelius Matějka, Francesco Pio Scognamiglio, Giuseppe Digilio, Hrafn Malmquist, Huma Zafar, Iordanis Kostelidis, Istvan Vig, Jonas Van Goolen, Kim Shepherd, Kristof De Langhe, Leonardo Guerrero, Lotte Hofstede, Luigi Andrea Pascarelli, Mark H. Wood, Martin Walk, Nicholas Woodward, Pascal-Nicolas Becker, Paulo Graça, Philip Vissenaekens, PTrottier, Saiful Amin, Samuel, santit96, ssolim, Terry Brady, Tim Donohue, Toni Prieto.








  • No labels

All content on the LYRASIS Wiki is licensed under the CC BY (Attribution) license, unless otherwise noted.