Releases/Release announcements/Release 2.6.2 - Revision history

Dan: /* Security patch */

2021-02-04T20:54:02Z

‎Security patch

Dan: Add 2.6.2 release details

2021-02-04T20:21:59Z

Add 2.6.2 release details

Dan: Add size of tarball

2021-02-04T18:28:37Z

Add size of tarball

Dan: Add initial release page details

2021-02-03T21:33:58Z

Add initial release page details

New page

{{#pagetitle:Release 2.6.2}}
[[Main Page]] > [[Releases]] > [[Releases/Release announcements]] > Release 2.6.2

'''Release date''': February 4, 2021

'''Download link''': [http://storage.accesstomemory.org/releases/atom-2.6.2.tar.gz atom-2.6.2.tar.gz] '''(LINK NOT YET ACTIVE)'''

'''Database schema version''': v184

'''Release 2.6.2''' is a security patch release for the 2.6.0 AtoM release. It includes only one bug fix to address a recently discovered security vulnerability affecting AtoM 2.4, 2.5, and 2.6. Further disclosure details will be included here once the release is publicly available.

Visit the [https://www.accesstomemory.org/download/ Downloads] page to download the most recent release, and consult the 2.6 [https://www.accesstomemory.org/docs/2.6/admin-manual/installation/upgrading/ Upgrading] and [https://www.accesstomemory.org/docs/2.6/admin-manual/installation/linux/linux/ Installation] guides in our documentation for further information.

==Security patch==

* #13470

Further details will be included once the release becomes publicly available. Patches will be provided for 2.4 and 2.5 installations.

<admonition type="seealso">
For a full list of issues related to the 2.6.2 release, see the following link to our issue tracker:

* [https://projects.artefactual.com/versions/133 Release 2.6.2 Roadmap / Overview]
* #13470
</admonition>

-----

* [[Releases/Release_announcements|Back to Release announcements]]
* [[Releases|Back to Releases]]
* [[Main Page|AtoM wiki Home]]

[[Category:Releases]]

@@ Line 32: / Line 32: @@
 * [https://projects.artefactual.com/versions/133 Release 2.6.2 Roadmap / Overview]
-* #13470
+* #[https://projects.artefactual.com/issues/13470 13470]
 </admonition>

@@ Line 4: / Line 4: @@
 '''Release date''': February 4, 2021
-'''Download link''': [http://storage.accesstomemory.org/releases/atom-2.6.2.tar.gz atom-2.6.2.tar.gz] (18.7MB) '''(LINK NOT YET ACTIVE)'''
+'''Download link''': [http://storage.accesstomemory.org/releases/atom-2.6.2.tar.gz atom-2.6.2.tar.gz] (18.7MB)
 '''Database schema version''': v184
@@ Line 14: / Line 14: @@
 ==Security patch==
-* #13470
+* #13470 - Clipboard toggle endpoint is vulnerable to SQL injection
-Further details will be included once the release becomes publicly available. Patches will be provided for 2.4 and 2.5 installations.
+Thanks to a [https://github.com/artefactual/atom/blob/qa/2.x/SECURITY.md security report] from the [https://archives.un.org/ United Nations Archives and Records Management Section] and [https://asc.library.carleton.ca/ Carleton University Library], we have patched a [https://portswigger.net/web-security/sql-injection SQL injection] vulnerability caused by a non-parameterized query on the clipboard, an issue found in releases 2.4, 2.5, and 2.6. This is a [https://portswigger.net/web-security/sql-injection/blind blind SQL injection] vulnerability, which fortunately reduces the range of exploits this might expose - but nevertheless should be taken seriously and addressed quickly.
 <admonition type="seealso">