Moodle Security Issue CVE-2017-2641

[UPDATE 2017-03-23]

For new application deployments, Bitnami has released Moodle 3.2.2 installers, containers, virtual machines and cloud images that address these vulnerabilities. If you deploy Bitnami Moodle via a Bitnami Launchpad, your application will be up-to-date and secure. If you deploy Bitnami Moodle via one of our cloud partner marketplaces and it is not yet updated to version 3.2.2, you should apply the workaround explained below.

----

The Moodle project has just released new versions that contain an important security fix for a SQL injection vulnerability via user preferences that can lead to remote code execution (CVE-2017-2641).

Moodle has released versions 3.2.2, 3.1.5, 3.0.9 and 2.7.19 that fix the issue. We believe it is of the utmost importance to quickly address any security issues in applications distributed by Bitnami. Our team is working to update all of the affected Moodle packages available through Bitnami as quickly as possible.

Workaround

In the meantime, we strongly encourage all Moodle administrators to apply the security patch published by the Moodle maintainers. In order to do so, log in to your Moodle installation and run the following commands:

$ curl -L -o /tmp/security.path 'https://git.moodle.org/gw?p=moodle.git;a=patch;h=6e65554ea19f4e90c09864081e47424f8efca02e'
$ cd /opt/bitnami/apps/moodle/htdocs
$ sudo patch -p1 < /tmp/security.patch
$ rm /tmp/security.patch

If you have further questions about Bitnami Moodle or this security issue, please post to our community forum, and we will be happy to help you.

Security Release: Moodle

Moodle has just released an update to all supported versions that addresses several security issues. The security vulnerabilities have been discovered and fixed, in addition to a number of bug fixes and small improvements.

Specifically, the update solves the following issues:

• MDL-48778 - Fixed problems with "assign quick grading" in case of multiple attempts
• MDL-31635 - Changed course completion "grade" criteria to correctly show grades as points and not percents
• MDL-21912 - Introduced new setting "Allow admin conflict resolution" for restoring a course from a different Moodle site
• MDL-51702 - Restored ability to assign roles to blocks in Default Dashboard and My page
• MDL-49807 - Changed wiki table of contents to correctly display headers created in Atto editor

To read more about these issues, check out Moodle's official announcement.

We have released new versions of Bitnami Moodle installers, virtual machines and Amazon EC2, Google, Oracle, VMware vCloud Air, DigitalOcean and Azure cloud images that fix these issues. 

Do you have questions about Bitnami Moodle or the security issue? Post to our community forum, and we will be happy to help you.

Moodle 3.0.2 and 2.9.4 Security Release

The Moodle Project has just released new versions that resolve a number of security issues.

Version 3.0.2 and 2.9.4 address these security vulnerabilities and include other fixes and improvements.

If you want to read more about the issues, you can check out the Moodle release news for the 3.0.2 and 2.9.4 versions.

We have released Bitnami Moodle installers, virtual machines and Amazon EC2, Google, Oracle, VMware vCloud Air, DigitalOcean and Azure cloud images that fix these issues.

Have questions about Bitnami Moodle or the security issue? Post to our community forum, and we would be happy to help you.

Moodle 2.8.0 released

Moodle, the popular Open Source e-learning platform, released their version 2.8.0 a couple of days ago. We are glad to announce that this version is already available in Bitnami.

You can find the complete list of new features in the official release notes and you can also take a look at the screenshots.

Bitnami Moodle is available as native installers (available for Linux, Windows and Mac OS), virtual machines and cloud images for Amazon EC2, Azure and Google Cloud Platform.

New “Education & Research” category within the AWS Marketplace

Amazon Web  Services has just launched a new "Education & Research" category in the AWS Marketplace. With this new category of applications, educational institutions will be able to easily browse and select software focused on teaching and research. Among others, you can find the Bitnami Moodle cloud image which provides a one click deployment for Moodle, one of the most popular open source e-learning platforms.

The University of San Francisco, University of California at Berkeley and Harvard Medical School are just a few of the AWS users who are benefitting from these educational applications. AWS also provides education programs that enable the academic community around the world to easily leverage the benefits of Amazon Web Services for education and research. 

Moodle 2.5 released. New add-ons web installer and much more.

We are happy to announce a new major version of BitNami Moodle Stack. Installers, virtual machines and cloud images for both Windows Azure and Amazon cloud are already available.

Moodle, one of the most famous open source Course Management System, has added new interesting features for teachers, students and administrators in its version 2.5.

• Moodle now allows to award badges based on a variety of chosen criteria.  
• Important improvements to the usability of big complex Moodle forms, now non-essential settings on forms are collapsed by default. 
• It includes several enrolement-related improvements. 
• Ability to drag and drop media and text onto the course page.
• Support for all screen sizes (including phone and tablet) thanks to the Bootstrap-based themes.
• Add-ons can be installed from the admin web interface.

You can experience all these new features by launching a free demo server with BitNami Cloud Launchpad.

For a full list of improvements and new features please check Moodle 2.5 releases notes.

 

We would like to highlight the new admin tool for installing add-ons. The process for installing Moodle plugins in previous versions required the administrator to access the machine, download the plugin, uncompress it in a specific folder depending on the plugin type, then go to the notifications panel and update the application.

However, with this new tool, login into the system is not required. The administrator user can just go to the Install add-ons options in the left menu, and select the plugin directly from the Moodle plugin directory or choose a zipped file to upload.

The plugin will be validated and then you can confirm to install it.

Please note that although this is a great feature, allowing to install add-ons from the web interface currently requires to grant write permission to the web service group on Unix systems. If you are paranoid about security and you are ok with installing the plugins manually (as you always did with Moodle before) you can deactivate this feature as it conflicts with the Moodle Security recomendations. Check our wiki to learn more about how to deactivate the install add-ons option in the BitNami servers.