OTOBO Release Notes

OTOBO 10.0.17 – a security patch

20 December 2022

Security-related:

  • SQL Injection: We fixed a vulnerability anabling attackers to inject SQL code in the webservice operation TicketSearch. CVE-2022-4427, Severity: 6.5. MEDIUM
  • JS Injection: Fixed a vulnerability in the admin interface enabling attackers with OTOBO admin permissions to inject JS Code
  • Admin Interface: Fixed a vulnerability enabling attackers with OTOBO admin permissions to inject code via ACLs

Thanks to Tim Püttmann (maxence) for reporting those issues.

Criticality: Medium (5.6)

Außerdem neu in OTOBO 10.0.17

  • [Bugfix]   Appointment notifications are now sent when IsVisibleForCustomer is set
  • [Bugfix] CLOB colums are now base64 decoded when migrating from Oracle to MariaDB
  • Fixed the Perl 5.34 shmwrite problem in OTOBO 10
  • [Tidied]   Updated JavaScript libraries
    Careful: Mind our notes on handling manual changes to Loader::Agent::CommonJS###000-Framework and Loader::Customer::CommonJS###000-Framework (see below).
  • [Bugfix]   Fixed SMIME for newer openssl versions.
  • [Bugfix] Fixed a Bug in LDAP groups to OTOBO roles synchronization

Please update your system.

Notes on changed SysConfig options in OTOBO 10.0.17

JavaScript

As in OTOBO 10.1, several Javasript libraries have been updated with this patch.
They are defined in the SysConfig options "Loader::Agent::CommonJS###000-Framework" and "Loader::Customer::CommonJS###000-Framework".

In case you changed these options manually in the SysConfig (which we do NOT recommend), it will not be possible to automatically update them.

In this case, please note down your changes, reset your settings, run the update and manually adapt the option again, if needed.

Visit Download page