Dear list members,
today we received several requests regarding CVE-2021-44228 (log4j -
0-day exploit).
According to our own analysis ILIAS and (more precisely) the ilServer is
most probably NOT affected by this vulnerabilty.
The java server uses the 1.x release of log4j, which seems to be NOT
impacted if(!) the configuration of the application does not(!) use JNDI
or JMS Appender, which is given for the ilServer.
Nevertheless the maintainer of the ilServer decided to upgrade the log4j
library to the recommended version 2.15.x in all maintained ILIAS
releases (still in progress).
We would like to also create awareness that other applications in your
infrastructure might be impacted by CVE-2021-44228.
We always recommend to keep your ILIAS installations up-to-date. For
more detailed explanations don't hesitate to contact us.
Best regards,
The ILIAS Security Group
on behalf of the ILIAS e.V. and the Technical Board
Dear developers,
I recently merged my pull-request (#3710) into trunk, which introduced a
static ilCtrl.
What I forgot to mention is that plugin configuration GUIs no longer work
"magically" as they did before. Every plugin config GUI now needs an
according `@ilCtrl_isCalledBy` statement, that references at least
`ilObjComponentSettingsGUI`. Otherwise link-targets to the config GUI can
no longer be determined and throw an exception.
Best regards,
--
*Thibeau Fuhrer*
Junior Software Developer
*Team ILIAS Core 1*
phone +41 31 972 52 30
support-core1(a)studer-raimann.ch
*studer + raimann ag*
IT- and Learning-Solutions
Farbweg 9
3400 Burgdorf
main +41 31 972 52 22
studer-raimann.ch
Dear colleagues,
the beta phase of ILIAS 8 is coming soon. On behalf of the Technical Board of the ILIAS society i want to remind you:
Please look into the dependencies that you have introduced [1][2]. Update them to current versions of the library. Replace or remove them if they are abandoned, unmaintained or in the risk of becoming so. When doing so, follow the procedures we have agreed on [3][4].
Please make sure to understand that every dependency we use is a liability that we have accepted. We get functionality for free but in turn need to make sure that we keep our dependencies up to date. Outdated or unmaintained dependencies are a real danger to the security and reliability of our system.
Best regards!
[1] https://github.com/ILIAS-eLearning/ILIAS/blob/f187dc38da4b815125a3fb4d17c49…
[2] https://github.com/klees/ILIAS/blob/trunk/package.json#L62
[3] https://github.com/klees/ILIAS/blob/trunk/libs/composer/README.md
[4] https://github.com/klees/ILIAS/blob/trunk/docs/development/js/third-party-l…
---------------------------------------------
CaT Concepts and Training GmbH
Vorgebirgstraße 338
50969 Köln
Fon: +49 (0) 221 / 46 75 76 - 00
Fax: +49 (0) 221 / 46 75 76 - 09
---------------------------------------------
Geschäftsführung:
Sven Kapust, Gerald Konrad, Alexandra Oehlke,
Sandra Röbbelen, Volker Röbbelen, Denis Witt
Amtsgericht Köln HRB 57804
Ust-ID-Nr.: DE 814694228
Sitz: Köln
---------------------------------------------
Dear colleagues,
the Technical Board kindly asks each of you to have a look into the dependencies that you have introduced to ILIAS. Please update your dependencies in the trunk to a current version and replace or remove dependencies that are not maintained anymore. When doing so, please follow the procedures [1] we have agreed on to handle dependencies.
Make sure to understand, that outdated dependencies represent a substantial risk to the security of the application, as well as a risk for the functionality in ILIAS that requires these dependencies. This is why we need to update or replace our dependencies periodically. Fabian Wolf updates the composer dependencies to current patch or bugfix versions when releasing [2], but this does not cover javascript dependencies, unmaintained dependencies or updates to new major versions of composer libraries. In these cases, we need you to manually update and test the results.
If there are any questions or concerns, feel free to contact the Technical Board at tb(a)lists.ilias.de or raise them on the Jour Fixe.
Thanks and best regards!
[1] https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/libs/README.md
[2] https://github.com/ILIAS-eLearning/ILIAS/pull/3714
--
Richard Klees
on behalf of the Technical Board of the ILIAS society
Mobil: +49 (0)173 / 52 56 924
Fon: +49 (0)221 / 46 75 76 - 56
Fax: +49 (0)221 / 46 75 76 - 09
---------------------------------------------
CaT Concepts and Training GmbH
Vorgebirgstraße 338
50969 Köln
Fon: +49 (0) 221 / 46 75 76 - 00
Fax: +49 (0) 221 / 46 75 76 - 09
---------------------------------------------
Geschäftsführung:
Sven Kapust, Gerald Konrad, Alexandra Oehlke,
Sandra Röbbelen, Volker Röbbelen, Denis Witt
Amtsgericht Köln HRB 57804
Ust-ID-Nr.: DE 814694228
Sitz: Köln
---------------------------------------------
Dear all,
We would like to publish ILIAS 5.4.24 on Wednesday, October 13, 2021.
If you need more time to fix issues that should become part of this
release, please let me know.
Best regards
Fabian Wolf
