WordPress security issue: Unauthenticated Remote Code Execution (RCE)

A critical security WordPress vulnerability was recently published. The Remote Code Execution PoC exploit described in this advisory is based on version 4.6. However, other versions of WordPress prior to 4.7.1 may also be affected.

The WordPress team strongly encourages their users to update their Wordpress site(s) to the most recent version: 4.7.4.  If you already have a running version of Bitnami WordPress, the application can be updated from the admin panel. Note that the Automatic Background Upgrades functionality is enabled by default but upgrading from 4.6.x to 4.7.y is not automatic. You can confirm that the update has been done by checking the version from within your admin panel.

We have released Bitnami WordPress 4.7.4 (and Multisite version) installers, virtual machines and cloud images for all platforms.

Have questions about Bitnami WordPress or the security issue? Post to our Community Forum, and we would be happy to help you.

New Node.js version 4.0.0 available on Bitnami!

The Node.js foundation has released version 4.0.0 (stable) that fixes important issues, improves its functionality and upgrades some of its included dependencies. 

It is a big upgrade from the last stable version (0.12.7) that released on July. You may be wondering why jump from 0.x to 4.x, that is because of io.js last version is 3.x and to avoid collision with Node.js it was decided to merge on 4.

• Node.js and io.js are united.
• NPM: Upgrade to version 2.14.2 from 2.13.3, that includes a security update.
• v8: Upgrade to version 4.5.103.30 from 4.4.63.30. 
• Node-gyp: This release bundles an updated version of node-gyp that works with all versions of Node.js and io.js including nightly and release candidate builds. From io.js v3 and Node.js v4 onward, it will only download a headers tarball when building addons rather than the entire source. 

You can find more information about this release on Node.js webpage.

We have released Bitnami Node.js version 4.0.0 on installers, virtual machines and cloud images.

Have questions about Bitnami Node.js or anything related? Post to our community forum, and we will be happy to help you.

Security release: Magento 1.9.2

The Magento project has just released a new community version that includes the latest security patches: SUPEE-5344, SUPEE-5994, and SUPEE-6285. It is recommended that you apply those patches or upgrade to the latest version of the application. For more information about the security issues fixed with those patches check out this helpful user guide. 

We have released Bitnami Magento 1.9.2 installers, virtual machines and Amazon EC2, Google and Azure cloud images that fix these issues.

If you already have a running version of Bitnami Magento, you can upgrade the application following the steps detailed on our wiki page.

To learn more about this new version, you can read about them on the Magento blog. Have questions about Bitnami Magento? Post to our community forum, and we would be happy to help you. 

Updated Redmine stack and upgrade instructions

We are happy to announce new BitNami Redmine stacks for the 2.1.3 and 1.4.5 versions of the popular project management tool. Both versions are running now the latest stable version of Ruby, 1.9.3-p327 and the latest passenger 4 beta which significantly improve the performance of the application. Check our previous post for more details of the enhancements we have been implementing for all Ruby-based apps in the BitNami library.

If you are an existing Redmine user, the rest of the article explains step-by-step instructions on how to upgrade to the latest version using the BitNami stack. 

First, check the plugins that you are currently using and make sure that they support the latest 2.1.x version. If your plugins are not compatible with the 2.x releases, you may want to upgrade to the latest BitNami Redmine 1.4.5 version instead.

Next, create a backup of your previous installation. It is necessary to create a database backup and make a copy of your uploaded files. The steps below are valid to upgrade from a previous BitNami Redmine installation, in a non-BitNami installation the process should be similar.

$ /installdir/mysql/bin/mysqldump -u root -p bitnami_redmine > redmine_backup.sql

$ tar -czvf redmine-files.tar.gz /installdir/apps/redmine/htdocs/files

The next step is to install the new BitNami Redmine version. You can download a native installer, the virtual machine or start a new instance in the Amazon cloud. You can use the same machine or you can consider migrating your servers to the cloud (heck out some reasons why you may want to move your infrastructure to the cloud)

Once you have the new Redmine version running, install the plugins that you need. Then copy the database backup and the files directory backup to the machine and restore them. Check that you are running these command from the BitNami Redmine console, so the appropriate environment variables are preloaded.

$ /installdir/mysql/bin/mysql -u root -p bitnami_redmine < redmine_backup.sql

$ tar -xzvf redmine-files.tar.gz /installdir/apps/redmine/htdocs/

Next, migrate the database to the new version.

$ cd /installdir/apps/redmine/htdocs

$ rake db:migrate RAILS_ENV=production

If you have installed plugins, you should run the following command:

$ rake redmine:plugins:migrate RAILS_ENV=production

Alternativelt, if you are using the 1.4.x version, the migration command is the following:

$ rake db:migrate_plugins RAILS_ENV=production

If you find any issue during the migration, check our Wiki or post in our forum. Now you can start Redmine again and access it via the web. You will probably want to configure the email settings in the new Redmine installation in the "/installdir/apps/redmine/htdocs/config/configuration.yml" file. You can find here an example using a GMail account.

Finally, some users also want to change the URL to access the app from the root of the domain name (http://example.com instead of http://example.com/redmine). The below provides sample configuration changes.

DocumentRoot /installdir/apps/redmine/htdocs/public

#Alias /redmine /installdir/apps/redmine/htdocs/public

<Directory "/installdir/apps/redmine/htdocs/public">

  Options -MultiViews

  allow from all

</Directory>

#<Location /redmine>

#  SetEnv RAILS_RELATIVE_URL_ROOT "/redmine"

#  RackBaseURI /redmine

#</Location>

PassengerPreStart http://example.com/

That's all! Enjoy your new, faster than ever Redmine, powered by BitNami.