<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Dear All,</div>
<div><br>
</div>
<div>Today we are releasing OMERO 5.4.7, a bug-fix release which also introduces some new functionality.</div>
<div><br>
</div>
<div>It includes security fixes for 2018-SV1 POST password [1], 2018-SV2 Script Name UUID [2] and 2018-SV3 Modify User Password [3]. It is highly recommended that you upgrade.</div>
<div><br>
</div>
<div>Impacts of the security vulnerability fixes include:</div>
<div><br>
</div>
<div>* omero.security.password_required=false no longer applies for</div>
<div> administrators: their correct password is always required</div>
<div>* administrators can no longer change the password of other</div>
<div> administrators who are more privileged in any way</div>
<div>* administrators can no longer reset their password and receive the new</div>
<div> one by e-mail: they must instead have another administrator who is at</div>
<div> least as privileged set a new password manually</div>
<div>* cli: the session UUID has been removed from the standard output when</div>
<div> logging in but can still be retrieved using `bin/omero sessions key`</div>
<div><br>
</div>
<div>Improvements include:</div>
<div><br>
</div>
<div>* web: fix loss of privileges when editing full admins</div>
<div>* web: fix exceptions on invalid connections</div>
<div>* web: fix CSS in group/user search element</div>
<div>* web: fix error when public user is disabled</div>
<div>* web: gray out user role when editing root user</div>
<div>* insight: permit open_with on original files</div>
<div>* read-only: reduce error logging for scripts and pixel data</div>
<div>* scripts: improve error messages for invalid MATLAB</div>
<div>* as well as various documentation improvements</div>
<div><br>
</div>
<div>Sysadmin improvements include:</div>
<div><br>
</div>
<div>* log locale and time zone information on startup</div>
<div><br>
</div>
<div>Developer updates include:</div>
<div><br>
</div>
<div>* cli: clean up "communicator not destroyed" logging</div>
<div>* cli: don't hang when incorrect password passed in a script</div>
<div>* java: add a map annotation example</div>
<div>* java: throw a clear exception when -1 is used for all groups</div>
<div>* web: fix @render_response when extending base templates</div>
<div>* matlab: contributions from Kouichi Nakamura for working with annotations</div>
<div><br>
</div>
<div>This release also upgrades the version of Bio-Formats which OMERO</div>
<div>uses to 5.9.0. **Note:** this is a significant upgrade and will</div>
<div>invalidate the Bio-Formats Memoizer cache. Please see the upgrade</div>
<div>guide for further information.</div>
<div><br>
</div>
<div>OME policy is that security releases should not invalidate the Bio-Formats Memoizer cache. However, our previous OMERO 5.4.6 release accidentally included a Bio-Formats merge artifact that did not receive the quality assurance we require of release versions.
We have now updated the version of Bio-Formats included in OMERO 5.4.7 and this will cause a refresh of the Memoizer cache. We apologize for this unfortunate mistake and for the extra work required by our users. We have adjusted the internal processes that
caused it.</div>
<div><br>
</div>
<div><br>
</div>
<div>Upgrade information is on the server upgrade page - <a href="https://docs.openmicroscopy.org/omero/5.4.7/sysadmins/server-upgrade.html">https://docs.openmicroscopy.org/omero/5.4.7/sysadmins/server-upgrade.html</a>.</div>
<div><br>
</div>
<div>The software is also available at <a href="https://downloads.openmicroscopy.org/omero/5.4.7">https://downloads.openmicroscopy.org/omero/5.4.7</a>.</div>
<div><br>
</div>
<div>Any problems or comments, please use the OME Forums or mailing lists - <a href="https://www.openmicroscopy.org/support/">https://www.openmicroscopy.org/support/</a></div>
<div><br>
</div>
<div><br>
</div>
<div>Regards,</div>
<div><br>
</div>
<div>The OME Team</div>
<div><br>
</div>
<div>[1] <a href="https://www.openmicroscopy.org/security/advisories/2018-SV1-post-password/">https://www.openmicroscopy.org/security/advisories/2018-SV1-post-password/</a></div>
<div>[2] <a href="https://www.openmicroscopy.org/security/advisories/2018-SV2-script-name-uuid/">https://www.openmicroscopy.org/security/advisories/2018-SV2-script-name-uuid/</a></div>
<div>[3] <a href="https://www.openmicroscopy.org/security/advisories/2018-SV3-modify-user-password/">https://www.openmicroscopy.org/security/advisories/2018-SV3-modify-user-password/</a></div>
</div>
<br>
<span style="font-size:10pt;">The University of Dundee is a registered Scottish Charity, No: SC015096</span>
</body>
</html>