Friday, November 10, 2017

Roundcube 1.3.3 security release

The RoundCube project has recently discovered a file disclosure vulnerability in Roundcube Webmail.

Apparently this zero-day exploit is already being used by hackers to read Roundcube’s configuration files. It requires a valid username/password as the exploit only works with a valid session. More details will be published soon under CVE-2017-16651. RoundCube versions 1.1.x are affected by this vulnerability. However, versions 1.0.x, that are not affected by it, have been patched with the same fix as well.


We advise you to check your Roundcube installation to see if it has been compromised. Please check the Apache access logs (installdir/apache2/logs/access_log) for requests like:

?_task=settings&_action=upload-display&_from=timezone 


More information about this vulnerability can be found in the official announcement.

For new application deployments, including the Bitnami Launchpad, we have released Roundcube 1.3.3 installers, virtual machines and cloud images that include the security fixes to address this vulnerability. Users launching Bitnami Roundcube via a cloud marketplace are advised to select version 1.3.3, once it is published.

If you have further questions about this security issue or about Bitnami Roundcube, please post to our community forum. Our support team will be happy to help you there!

Thursday, November 9, 2017

Announcing Bitnami WordPress Multi-tier with Amazon Aurora



Bitnami is the leading publisher of free and open source software in the AWS Marketplace, the online store where AWS users can find thousands of software titles to run in their cloud accounts. Our mission is to make awesome software available to everyone, everywhere by publishing fully configured, secure, and up-to-date applications and development stacks. In keeping with that goal, we are proud to announce our new WordPress Multi-tier with Amazon Aurora, now available in AWS Marketplace!

Using the Cloud Formation Template (CFT) written by Bitnami, you can now deploy a WordPress instance with all the features of Amazon Aurora right through the AWS Marketplace. Like all Bitnami apps, it is completely pre-configured and can be deployed in just a few clicks.

Aurora is a relational database service provided by Amazon. We have replaced the MySQL server we would typically package in a WordPress image, using Aurora as a separate database tier instead. When you deploy the CFT through the AWS Marketplace, it automatically provisions a new Aurora instance that is pre-networked and configured to work with the WordPress application instance running in EC2.

Why does this matter?

A single-VM WordPress instance works great for lower-traffic sites used for small businesses or personal websites. For websites that need to handle a substantial amount of traffic, a more robust architecture may be necessary. Separating the database into a separate layer enables you to run your database on machines designed for that purpose, as well as manage them independently of the application layer. It also gives you more control over how you administer the application and web server.

What makes our new WordPress with Aurora exciting is that Aurora gives you the performance of a high-end database with costs similar to what you pay for regular EC2 usage (in other words, inexpensive). According to Amazon, Aurora delivers five times the throughput of standard MySQL at a tenth the cost. It is highly available with up to 15 low-latency read replicas, can be replicated across up to three availability zones, and comes with fault-tolerant and self-healing distributed storage out-of-the-box. Using Aurora for the database removes the need to handle administrative tasks like backups, updates, and patches as well- it all happens automatically, behind the scenes.

Configuring a WordPress instance with all of the same functionality you get with the Bitnami WordPress with Amazon Aurora used to be a difficult process that would be daunting even for an expert. You can now get a production-ready WordPress website up and running, and ready to handle large amounts of traffic, in a matter of minutes.

Give it a try, and let us know in the comments what you think!

Security Release: CouchDB 2.1.1

The CouchDB project has just announced the immediate availability of a new version that fixes multiple critical security vulnerabilities.

The detailed description of those security vulnerabilities will not be published until November 14th, but updating the server is mandatory. It is highly recommended that you update your CouchDB server to 2.1.1.

Apart from those vulnerabilities, the new version includes several improvements. More information about these improvements can be found in the official announcement.

For new application deployments, including the Bitnami Launchpad, we have released CouchDB 2.1.1 installers, virtual machines and cloud images that include the security fixes to address these vulnerabilities. Users launching Bitnami CouchDB via a cloud marketplace are advised to select version 2.1.1, once it is published.

If you have further questions about this security issue or how to update your Bitnami CouchDB, please post to our community forum. Our support team will be happy to help you!