Jahia 8.1.9.1

Jahia 8.1.9.1 is a patch release addressing security-related issues. You can find more details about the corrected vulnerabilities in the Security section of Jahia Academy.

Upgrading from a version earlier than 8.1.9.0? Make sure to review Jahia 8.1.9.0 release notes as well as all intermediary patch releases.

Read before you upgrade

Breaking changes

Breaking changes are documented on the page of the release that introduced them. If you are upgrading across more than one version, review the breaking changes of every release between the version you are currently running and the version you are upgrading to.

Password update security

In Jahia 8.1.9.1 a short-lived server-side validation window was introduced: after a successful current-password verification, a password change may be performed without re-supplying the current password, provided it occurs within the same request / thread context and within the allowed time window (configurable, defaults to 10s).

The fixes implement a window during which a password can be modified after having been first verified. If your code already follows the pattern verifyPassword(currentPassword) followed by setPassword(newPassword) in the same thread, no changes are required.

If you perform the two operations in different threads, or separated requests without re-verification, you must refactor your code. A sample implementation of a valid password change is available in the jahia user dashboard (code).

It remains possible to restore previous behaviour by setting jahia.user.passwordUpdate.currentPasswordRequired property to false.

How to upgrade

Customers can always use the In-Place or Blue-Green upgrade procedure regardless of their current version. The rolling upgrade prerequisites below only apply to the rolling upgrade procedure.

Rolling upgrade to Jahia 8.1.9.1

Rolling upgrade to 8.1.9.1 from any version earlier than 8.1.9.0 is not supported.

Rolling upgrade from 8.1.9.0 to 8.1.9.1 is supported, but requires the following modules to be upgraded on the cluster before starting the Jahia node upgrade:

• tasks 8.3.0 (download)

Note: Depending of the version of Jahia you are upgrading from, some modules might already be in the required version.

Failing to upgrade these modules beforehand WILL result in instability during the rolling upgrade window when nodes are running different Jahia versions. Downgrading IS NOT supported.

If you are using Jahia installer, you can download fixAppliers corresponding to your Jahia version here.

Components updated in Jahia 8.1.9.1

Modules

Only components whose version changed in Jahia 8.1.9.1 are listed above.

The full list of Jahia modules and their versions can be found in the Jahia 8.1.9.1 tag in GitHub.

Database drivers

No changes to database drivers in this version.

The full list of Database drivers and their versions can be found in the Jahia 8.1.9.1 tag in GitHub.

Libraries

No changes to libraries in this version.

The full list of embedded Jahia libraries can be found in the Jahia 8.1.9.1 tag in GitHub.

Changelog

Security

• 🛡️ Introduction of a password change window
• 🛡️ Addressed two XSS vulnerabilities in Jahia Administration

Core

• 🐛 Better handle exceptions to prevent log flooding

Legend (icons): ✨ Improvements & new features, 🐛 Bugs, 🛡️ Security fixes, 📚 Documentation, 📦 Packaging, 🛠 Change to Jahia build, ⚙️ Changes to CI, ♻️ chores