JasperReports 7.1.1 security release

TIBCO JasperReports has recently been updated to fix five security vulnerabilities in the application.

Community Edition versions 7.1.0 and below are affected by four vulnerabilities that allow unauthenticated read access to the contents of the host system and a race-condition vulnerability that may allow any user with domain save privileges to gain superuser privileges. More information about these security issues can be found in the official advisories:

• TIBCO JasperReports Library Directory Traversal Vulnerability - CVE-2018-18809
• TIBCO JasperReports Server Privilege Escalation Via Race Condition - CVE-2018-18808
• TIBCO JasperReports Persistent Cross Site Scripting Vulnerability - CVE-2018-18816
• TIBCO JasperReports Server XML Entity Expansion Vulnerability - CVE-2018-8986
• TIBCO JasperReports Server User Information Disclosure - CVE-2018-18815

TIBCO has released an updated version of the application which addresses these issues. For new application deployments, including the Bitnami Launchpad, we have released JasperReports 7.1.1 containers, installers, virtual machines and cloud images that include the security fixes to address these vulnerabilities. Users launching Bitnami JasperReports via a cloud marketplace are advised to select version 7.1.1, once it is published.

In case you already have a JasperReports server, use the official documentation to upgrade the application and address these issues.

If you have further questions about this security issue or about Bitnami JasperReports, please post in our community forum. Our support team will be happy to help you there!

Security Release: JasperReports 6.4.3

TIBCO JasperReports has released a new update that contains multiple security enhancements, including one that prevents remote code execution. We recommend that all JasperReports installations be upgraded to its new version (JasperReports 6.4.3) immediately.

TIBCO JasperReports Library Code Sandboxing Problem - CVE-2018-5429
TIBCO JasperReports Server Information Disclosure Vulnerability - CVE-2018-5430
TIBCO JasperReports Server Cross Site Scripting Vulnerability - CVE-2018-5431

For more information about these security issues, please refer to the different advisories.

Bitnami has released Bitnami JasperReports 6.4.3 Helm charts, containers, installers, virtual machines, and cloud images in order to address these security vulnerabilities. If you already have Bitnami JasperReports running on any of these platforms, you can upgrade the application by following the official upgrade guide.

Users launching Bitnami JasperReports via a cloud provider's marketplace are advised to select version 6.4.3, once it is published. Installations based on previous versions will need to be upgraded as described above.

If you have additional questions about Bitnami JasperReports, post them in our community forum, and we will be happy to help you.

TIBCO JasperReports 6.4.2 security release

TIBCO JasperReports has recently been updated to fix two security vulnerabilities in the application.

Versions 6.4.0, 6.3.2, 6.3.1, 6.3.0 and 6.2.3 and below contain a vulnerability which may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Version 6.4.0 is also affected by a vulnerability which fails to prevent remote access to the contents of the web application, including key configuration files. More information about these security issues can be found in the official advisories:

https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532
https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-server-2017

TIBCO has released updated versions of the affected components which address these issues. For new application deployments, including the Bitnami Launchpad, we have released JasperReports 6.4.2 containers, installers, virtual machines and cloud images that include the security fixes to address these vulnerabilities. Users launching Bitnami JasperReports via a cloud marketplace are advised to select version 6.4.2, once it is published.

If you have further questions about this security issue or about Bitnami JasperReports, please post in our community forum. Our support team will be happy to help you there!

New BitNami JasperReports 5.0 released

We are happy to announce a new major release of BitNami JasperReports stack, version 5.0. JasperReports is a popular open source Java report and analysis tool.

BitNami JasperReports provides all-in-one free native installers, virtual machines and Amazon Cloud Images that simplify JasperReports' installation.

In addition to this, we also provide simplified deployment and management of JasperReports in the cloud with BitNami Cloud Hosting. Sign up for our free developer plan to check it out!

This version ships the following components:

 -  JasperReports 5.0
 -  Apache Tomcat 7.0.33
 -  JDK 1.7.0_09
 -  MySQL 5.5.28

JasperReports 5 welcome page

JasperReports 5 sample report