Versions Compared

Old Version 1

changes.mady.by.user Mark H. Wood

Saved on

compared with

New Version 2

changes.mady.by.user Mark H. Wood

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Created release notes for DSpace 3.6

...

This release addresses the following security issues discovered in DSpace 3.x and below:

  • Directory path traversal vulnerability:  DS-3094 reported by Tim Donohue\[HIGH SEVERITY\] The XMLUI "themes/" path is vulnerable to a full directory traversal using [any-two-or-more-chars]:[any-full-file-path].  (DS-3094 - requires a JIRA account to access.)  This means that ANY files on your system which are readable to the Tomcat user account may be publicly accessed via your DSpace website.

Upgrade Instructions

...