Security update for PowerFolder Server is available
- The security update for PowerFolder Server is available. Please install it promptly: 28.2.100 for line 28.2, 26.4.100 for line 26.4.
- After installing you can lift the block on
/wopi/. Until then it stays in place — also for your document server. - PowerFolder Cloud: already runs on this build. Cloud customers need to do nothing.
- Running a release candidate? Please update to .100 anyway: it contains one further fix over the last RC.
Download
- 28.2.100 · Linux, full package: PowerFolder-Server_v28.2.100.tar.gz — SHA-256
165b1363648e948735d3fdba54b64bcb00826c4f9ee84c6d373db3b4f39913d0 - 28.2.100 · Windows, installer: PowerFolder-Server_v28.2.100_Installer.exe — SHA-256
e53cede884fd6cda1d0934f48b31f6dcf1928177c30b77ac7ca92e072e9c9e31 - 26.4.100 · Linux, full package: PowerFolder-Server_v26.4.100.tar.gz — SHA-256
d1147dc7e82d7f9b9da3b948b675b637a3b53224aa4381a1c6a507f64477819a - 26.4.100 · Windows, installer: PowerFolder-Server_v26.4.100_Installer.exe — SHA-256
d954e456bfd3a5fffd5c9c854615e6ebdf1324ed2b259ab25dc3ab929d84de5c
Verify the file before installing with certutil -hashfile <file> SHA256 (Windows) or sha256sum <file> (Linux).
Installation
- Windows: run the installer. It sets up the server, or updates an existing installation.
- Linux, new installation: unpack the
.tar.gzand set it up as a systemd service — the steps are inREADME-systemd.txtinside the archive. The package brings its own Java runtime. - Linux, existing installation: unpack the archive into a temporary directory, stop the service (
systemctl stop powerfolder), then copyPowerFolder-Server.jar,PowerFolder-Server.sh,jre64/andfonts/over the installation directory and start the service again. Keeplibs/— it holds your database driver, and the archive ships none. IfPowerFolder-Server.shwas edited locally (memory, paths), carry those settings over; from this version on, memory belongs in/etc/default/powerfolder-server.
Your data lives outside the installation directory and is left untouched: configuration, internal database, keys and logs in ~/.PowerFolder, the folders in ~/PowerFolders of the account the server runs as. Back up ~/.PowerFolder or your database before the update anyway. Also plan for server administrators to set up two-factor sign-in once afterwards.
What the update contains
The update closes the vulnerabilities exploited in the attack. We have brought forward security fixes that were already planned, and closed further vulnerabilities we found during the comprehensive review of our code. On top of that come new protections: mandatory two-factor sign-in for server administrators, shorter lifetimes for sign-in tokens and logging of administrator sign-ins and configuration changes. We will publish details of the individual vulnerabilities only once operators have had time to update.
For questions please use support.powerfolder.com.