DHIS2 security patch release 2.34.4, 2.35.5 and 2.36.1 are now available

Announcements - Annonces
, ,
1

Important security updates now available for DHIS2 v2.34, v2.35, v2.36

Security patches are now available for the following DHIS2 versions:

  • v2.34.4 – Update to v2.34.5 [1]
  • v2.35.2, v2.35.3, v2.35.4 – Update to v2.35.5 [2]
  • v2.36.0 – Update to v2.36.1

These patches address a critical security vulnerability. If your DHIS2 system is using one of the versions listed above, you should download and install the appropriate patch version immediately. Please go to Downloads - DHIS2 to download the WARs including the patch.

Earlier versions, such as 2.34.3 and 2.35.1 and all versions 2.33 and older are unaffected.

These updates are the first product of the newly formed DHIS2 Security team. You can read more about the process for identifying and reviewing potential security vulnerabilities on our website: Security - DHIS2

There are no known exploits of the security vulnerabilities addressed by these patch releases. However, we strongly recommend that all DHIS2 implementations using versions 2.34, 2.35 and 2.36 install these patches as soon as possible.

We have applied for a CVE related to this vulnerability, and will add information on that when it is available.

[1] For planning purposes, please note that 2.34.6 (a scheduled maintenance patch) will be released in the next day or two. It will also contain this security fix.

[2] For planning purposes, please note that 2.35.6 (a critical functional fix) will be released in the next day or two. It will also contain this security fix.

6 Likes
2

Hello @jaime.bosque thanks for the update. Do you know when the docker image will be update? The patch is not yet available in the docker hub.

1 Like
3

@diallotafsir52 version 2.36.1 is available on Docker Hub. We are publishing 2.35.5 and 2.34.5 Docker images now.

3 Likes
4

Thanks

5

Can we hear more about what part of 2.35.6 is a critical functional fix, as it has been noted in the footnotes? Thanks!

6

Hi @Matthew_Boddie , thanks for your concerns.

At the moment we have identified an issue with the trackedEntityInstance endpoint (used by Android and maybe other external apps could be affected) that might result in users posting TEIs (with events) and receiving an OK despite the events not being created. This results in a TEI not properly uploaded to the server but the end user believing the opposite.

2 Likes
7

well noted thanks @jaime.bosque !

8

i presume it is safe to upgrade from 2.35.3 to 2.36.1 directly no?
or you advise to go to 2.35.4 then 2.35.5 then possibly 2.35.6 then 2.36.1?
please advise.

9

Hi @SDKAAA ,

Yes, it is safe to upgrade directly to 2.36.1. Direct jumps to the “target” version are always the advised option (above version 2.30).

Kind regards,
Phil

P.S. see Upgrading docs :slight_smile:

2 Likes
10

HI @diallotafsir52 ,

2.34.5 and 2.35.5 are now also available on Docker Hub.

4 Likes
11

Seeing 2.35.6 released in Jira, but not seeing it in CoP as being released; just verifying this is ready for roll-out now?

12

Hi @Matthew_Boddie ,

2.35.6 is not quite ready for roll-out. We will communicate on the CoP when it is.

We make use of Jira attributes in various ways as part of our process, and set patches as “released” in Jira when we are starting to test the release candidate for the patch. (This facilitates our management as developers continue to work towards the following unreleased patch).

Kind regards,
Phil

1 Like
13

Hi

I am using version 2.26. How can i do to install the 2.36 version?
Thank you
Best Regards

14

Dear @joaoC ,

For guidance on upgrading, please refer to this document as a starting point:

Please pay particular attention to the need to safeguard your data, and to carefully read all of the relevant release and upgrade notes.

Kind regards,
Phil

2 Likes