Posted by: cathal connolly
Wednesday, September 02, 2009 9:38:00 PM 

 ***edited 10:55am Sep 03 - fixed typo, and updated issue status to correct value***

The 4.9.5 & 5.1.2 CE and PE versions of DotNetNuke has been released. The release notes can be read @ http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2348/DotNetNuke-4-9-5-and-5-1-2-Released.aspx

These releases fix 2 security issues, one "low" and one "medium". One was discovered by a community member, and the other was reported to us by an information security consultant. The bulletins can be read

As always we recommend you upgrade as soon as possible.

Please note, whilst the ClientAPI issue was fixed for both the 4.9.5 and 5.1.2 releases, it is recommended that you update to 5.1.2 as the ClientAPI has had additional defensive coding added to it, to protect against any future issues.

If you're new to upgrading I recommend you read the "detailed installation guide" found here , and the excellent set of blog entries from Erik here and here. For users who are running 4.6.2 or above, I recommend you read this blog entry which details how to use the upgrade package to easily merge any web.config changes.

You can read more details about these issues and our security policy here

• Low - HTML/Script Code Injection Vulnerability when working with multiple languages
• Medium- HTML/Script Code Injection Vulnerability in ClientAPI

Trackback Print

Tags:

Categories:

Location: Blogs Cathal Connolly Core :: Security