Following the last releases of 10.0.8, a few annoying issues has been detected:
- Update script uses a SQL function incompatible with MySQL 5.7 (#15141)
- Private follow-ups and tasks are invisible to users with appropriate rights (#15128)
In the same time, a moderate security advisory has been reported (SQL injection in dashboard administration – CVE-2023-37278) and fixed in this release.
We released a new version to address these bugs, you can download the GLPI 10.0.9 archive on GitHub.
We published corrective versions on september 14, 2022:
These fix two critical security vulnerabilities: a SQL Injection (CVE-2022-35947), and a Remote Code Execution (CVE-2022-35914, vulnerability in the third-party library, htmlawed), the latter has been massively exploited since October 3, 2022 to execute code on insecure servers, available on the internet, hosting GLPI (GLPI Network Cloud instances are not impacted).
If you are not on the latest version 9.5.9 or 10.0.3, you must update your instances according to the recommended method (from an empty folder, without overwriting existing GLPI files).
We noticed there is a scenario where the corrective versions can also be impacted: when a GLPI update has been performed, by unpacking the archive over the existing folders and files. We insist this way of updating GLPI is a bad practice and despite the current security problem, exposes you to bugs.
We invite you to correctly re-install your GLPI as indicated in the documentation:
- from an empty folder
- copy the files from the archive of the latest version
- get your
files/ directories from the old instance.
Workarounds to deal with RCE urgency (this does not fix SQL injection):
- delete the
vendor/htmlawed/htmlawed/htmLawedTest.php file (be careful not to touch the
htmLawed.php file which is legitimate).
- prevent web access to the
vendor/ folder by setting (in the case of Apache for example) an adequate
If your server has already been corrupted, you probably need to start from a new server, on which you will import your SQL dump and the folders mentioned above.
This version is compatible with GLPI 10 only.
documentation review and updates
- cannot delete a ticket from service catalog (acec9bb8)
- abstractitiltarget: alternative email lost if no requester user (78fd8450)
- abstracttarget: uuid should not be updated (b1e492d3)
- checkboxesfield: avoid HTML br tag (c3a60bbb)
- condition: compatibility with Advanced forms validation (6685b943)
- descriptinfield: conversion to target requires escaping (b79cfa95)
- filefield: mandatory check may cause exception (3f711a54)
- form: PHP warning (844ef96c)
- form: bad URL when using advanced form validation plugin (adb9fba5)
- formanswer: grid style updated for current version of gridstack (85b6a686)
- formanswer: select inherited class if needed (955dc969)
- formanswer: update gridstack css (70deaa06)
- glpiselectfield: missing entity restrict (40c9ab73)
- install: prevent useless warnings (001d12f5)
- install: use modern settings for tables (f04e4181)
- issue: remove duplicate item in status dropdown (27f9f313)
- ldapselectfield: log LDAP error instead of showing it to user (e170dc6f)
- ldapselectfield: no translation for items (d170c79c)
- targetticket: prevent exception in inconsistent target ticket (ba6ed88e)
- textarea: on change event broken (9fb70edb)
- textarea: rn chars added between lines (66571b80)
- textarea, entityconfig: embedded image question description (#2901) (0d78db1a)
- textareafield: embedded image upload broken (d58075cd)
- textareafield: missing escape before compare (ba78e935)
- formanswer: order formanswers by date desc (7fdeda51)
- ldapselectfield: lazy loading (bffcb5b7)
Help / Contribution needed
Locales updates: Some languages don’t have maintainer, or are late (many untranslated content). Please contribute on Transifex.
Check the changelog & download
A newly revealed critical vulnerability impacting Apache Log4j was disclosed and registered as CVE-2021-44228 with the highest severity rating. Log4j is an open-source, Java-based logging utility widely used by enterprise applications and cloud services. By exploiting this vulnerability, a remote attacker could take control of the affected system.
We would like to assure all users that GLPI core and its plugins, being written in PHP and not using Log4j, are not affected by the Log4Shell vulnerability.
Exploiting this vulnerability requires a Java Virtual Machine and the org.apache.logging.log4j.core.lookup.JndiLookup Java class in a vulnerable version. None of them are included or used in GLPI distributions.
We can also confirm that:
- GLPI Android Agent (writen in Java), doesn’t use Log4j library, and thus is not affected by the Log4Shell vulnerability
- GLPI Agent (writen in Perl), is not affected by the Log4Shell vulnerability
Warning: this does not prevent layers/tools potentially upstream of GLPI (reverse-proxy, firewall, etc.), or connected to GLPI, which we are not aware of in your context, from being potentially impacted.
For example, if you have a Metabase server connected to GLPI you should note that Metabase (<0.41.4) is affected by Log4j vulnerability, and you should update it ASAP!