# Security fix in Open OnDemand 1.8.18 and 1.7.19 patch releases now available

**URL:** <https://discourse.openondemand.org/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198>\
**Category:** Announcements\
**Created:** [November 4, 2020, 6:36pm UTC](https://discourse.openondemand.org/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198 "2020-11-04T18:36:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [November 4, 2020, 6:36pm UTC](https://discourse.openondemand.org/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198/1 "2020-11-04T18:36:43Z")

</div>

We have released 1.8.18 and 1.7.19 patch releases with security fixes:

- properly escape user input when creating job template in Job Composer app as reported as CVE-2020-27958 (thanks to reporting by Radoslav Bodó and the team at flab.cesnet.cz)

1.8.18 has some additional changes since 1.8.12 including:

- by default, set Content Security Policy frame-ancestors to the server name for all requests, which can be changed using the new security\_csp\_frame\_ancestors in the ood\_portal.yml [#697](https://github.com/OSC/ondemand/pull/697) and [#721](https://github.com/OSC/ondemand/pull/721)
- by default, set HTTP Strict Transport Security (HSTS) if SSL is in use, which can be disabled setting security\_strict\_transport: false in the ood\_portal.yml [#697](https://github.com/OSC/ondemand/pull/697)
- custom log formatting on apache and nginx access logs [#677] ([https://github.com/OSC/ondemand/pull/677](https://github.com/OSC/ondemand/pull/677)) (thanks to [Pavlos Daoglou](https://github.com/dpavlos))
- fixed XDMoD queries for staff users in the XDMoD reports [#688](https://github.com/OSC/ondemand/pull/688).
- make it easier to develop info.html.erb in batch connect apps by gracefully handling crashes and now rendering template from the app root instead of storing a copy of the template in the session [#666](https://github.com/OSC/ondemand/pull/666)
- better handling of Slurm squeue timeouts [209](https://github.com/OSC/ood_core/pull/209)
- fix Linux Host Adapter race condition in deleteing tmp files [212](https://github.com/OSC/ood_core/pull/212)
- can load .rb locale files alongside .yml locale files, enabling more dynamic localization [#645](https://github.com/OSC/ondemand/pull/645)
- warn users about job composer links to XDMoD jobs being broken immediately after job completes, since it wouldn’t yet be ingested into XDMoD [#676](https://github.com/OSC/ondemand/pull/676)
- ignore bad cache key values when updating from batch connect form cache [#655](https://github.com/OSC/ondemand/pull/655)
- properly escape characters in Go To dialog in Files app [#660](https://github.com/OSC/ondemand/pull/660)
- force update Files app dependencies using yarn resolutions [#661](https://github.com/OSC/ondemand/pull/661)
- xdmod widgets utilize available space on the dashboard when not displaying the MOTD [#676](https://github.com/OSC/ondemand/pull/676)

To upgrade from 1.8.12 to 1.8.18 or 1.7.18 to 1.7.19:

```
sudo yum update ondemand
```

---

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [November 4, 2020, 7:13pm UTC](https://discourse.openondemand.org/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198/2 "2020-11-04T19:13:26Z")

</div>



---

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [November 4, 2020, 7:13pm UTC](https://discourse.openondemand.org/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198/3 "2020-11-04T19:13:34Z")

</div>