Critical Security Vulnerability

bradymiller wrote on Wednesday, May 06, 2015:

Hi,

We plan to release a 4.2.0 patch to fix a critical security vulnerability this weekend, which also exists in prior versions.

We have committed the fix in the following two commits in the development codebase:


The fix does have the potential to unmask bugs in the code (albeit unlikely), so we are asking the community to test out the development codebase as much as possible over the next two days and report any new bugs you note. The fix affects the entire codebase, so testing everything you can is recommended. I have reset both of the development demos here to use this new code:
http://www.open-emr.org/wiki/index.php/Development_Demo#Daily_Build_Development_Demo

thanks,
-brady
OpenEMR

yehster wrote on Wednesday, May 06, 2015:

To secure your system in the meantime before the official patch comes out, download the updated version of this file (interface/globals.php) and replace the copy on your system.

https://raw.githubusercontent.com/openemr/openemr/e0b28722eb89c122c370e9c4228581bd35b4f0d5/interface/globals.php

bradymiller wrote on Saturday, May 09, 2015:

Hi,

Just released a patch for 4.2.0 to fix this critical security vulnerability:
http://www.open-emr.org/wiki/index.php/OpenEMR_Patches

If you are using a version prior to 4.2.0, then here are the changes that you need to be make to interface/globals.php (note the specifics of the security vulnerability will be publicly disclosed in the near future, so recommend fixing this ASAP):

-brady
OpenEMR

fsgl wrote on Saturday, May 09, 2015:

Thank you one & all.

bradymiller wrote on Monday, May 25, 2015:

Hi,

Another 4.2.0 critical patch is in the works, which will also require release of new installation packages (since it affects the install process).

Here is the related commit just committed to sourceforge:

If you can, please test it out and let us know if any issues. This is a critical security fix, so goal is to get patch and packages released by end of this week.

If you see following error:
FATAL ERROR: crypt() function is not working correctly in OpenEMR

Then let us know when it happened in addition to your operating system. We expect this to happen to some users(in at least one operating system so far). There is also a FAQ entry that was created to help users that this happens to:
http://www.open-emr.org/wiki/index.php/FAQ#What_is_.22FATAL_ERROR:_crypt.28.29_function_is_not_working_correctly_in_OpenEMR.22.3F

-brady
OpenEMR

bradymiller wrote on Saturday, May 30, 2015:

Hi,

Just released the patch #3 for 4.2.0 to fix above described critical security vulnerability:
http://www.open-emr.org/wiki/index.php/OpenEMR_Patches

More details here:
http://www.open-emr.org/wiki/index.php/OpenEMR_Patches#Special_Issues

Do plan to release new packages (except for XAMPP) soon with the patch since this affects install on some operating systems.

If you are using a version prior to 4.2.0, then here are the changes that you need to make:

-brady
OpenEMR