{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "KohaSupport Security Advisories",
  "description": "Security and patch advisories for KohaSupport Koha AMI customers on AWS Marketplace.",
  "home_page_url": "https://kohasupport.com/advisories/",
  "feed_url": "https://kohasupport.com/advisories/feed.json",
  "items": [
    
    
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-013/",
      "url": "https://kohasupport.com/advisories/ks-2026-013/",
      "title": "[HIGH] KS-2026-013: Persistent data volume not automatically mounted after AMI upgrade or instance replacement",
      "summary": "After an AMI upgrade or Auto Scaling Group instance replacement, the persistent data EBS volume (labeled 'kohadata') is not automatically detected and mounted by the new instance. The instance boots from the new AMI with empty default data, and the customer's library data appears lost until the volume is manually mounted and migrated.",
      "date_published": "2026-05-29T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["high", "patch_pending"],
      "_ks_advisory": {
        "id": "KS-2026-013",
        "severity": "high",
        "status": "patch_pending",
        "affected_versions": ["Standard tier AMI builds released before 2026-05-29 (x86_64 and arm64)"],
        "fixed_in": "Pending AMI release"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-012/",
      "url": "https://kohasupport.com/advisories/ks-2026-012/",
      "title": "[HIGH] KS-2026-012: Stack update may fail with 'SubnetList attribute not found' due to stale CloudFormation cache",
      "summary": "When updating an existing KohaSupport CloudFormation stack to a new AMI version, the stack update may fail with an error referencing a missing SubnetList or AllSubnetsToUse attribute. This is caused by CloudFormation reusing a cached Lambda response from the original stack creation.",
      "date_published": "2026-05-29T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["high", "patch_pending"],
      "_ks_advisory": {
        "id": "KS-2026-012",
        "severity": "high",
        "status": "patch_pending",
        "affected_versions": ["Standard tier AMI builds released before 2026-05-29 (x86_64 and arm64)","Free tier AMI builds released before 2026-05-29"],
        "fixed_in": "Pending CFN template release"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-011/",
      "url": "https://kohasupport.com/advisories/ks-2026-011/",
      "title": "[MEDIUM] KS-2026-011: S3 backup not configured automatically on first boot when enabled at install time",
      "summary": "When S3 backup is enabled during CloudFormation stack creation, the backup timer is silently not configured on first boot. Backups never run despite the option being set.",
      "date_published": "2026-05-29T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["medium", "patch_pending"],
      "_ks_advisory": {
        "id": "KS-2026-011",
        "severity": "medium",
        "status": "patch_pending",
        "affected_versions": ["Standard tier AMI builds released before 2026-05-29","Enterprise (ARM64) tier AMI builds released before 2026-05-29"],
        "fixed_in": "Pending AMI release"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-004/",
      "url": "https://kohasupport.com/advisories/ks-2026-004/",
      "title": "[MEDIUM] KS-2026-004: Koha data volume not encrypted at rest on Standard tier",
      "summary": "The Koha data EBS volume on Standard tier instances was not encrypted at rest. New Standard tier stacks launched from the patched AMI use a KMS customer-managed key (CMK) with automatic annual rotation.",
      "date_published": "2026-05-29T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["medium", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-004",
        "severity": "medium",
        "status": "fixed",
        "affected_versions": ["Koha Cloud Standard Tier AMI builds released before 2026-05-29"],
        "fixed_in": "Koha v25.11.04-1 (AMI build 2026-05-29)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-010/",
      "url": "https://kohasupport.com/advisories/ks-2026-010/",
      "title": "[LOW] KS-2026-010: OPAC search and menu toggles may fail to load on custom themes",
      "summary": "Custom themes may fail to load essential JavaScript files, breaking search and menu toggles.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-28T00:00:00+00:00",
      "tags": ["low", "patch_pending"],
      "_ks_advisory": {
        "id": "KS-2026-010",
        "severity": "low",
        "status": "patch_pending",
        "affected_versions": ["Koha AMI builds released before this patch"],
        "fixed_in": "Pending AMI release"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-009/",
      "url": "https://kohasupport.com/advisories/ks-2026-009/",
      "title": "[LOW] KS-2026-009: Domain setup arguments fail to parse correctly during installation",
      "summary": "Domain setup arguments are not correctly parsed during installation, causing domain configuration to fail.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["low", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-009",
        "severity": "low",
        "status": "fixed",
        "affected_versions": ["Koha AMI builds released before 2026-05-29"],
        "fixed_in": "Koha v25.11.04-1 (AMI build 2026-05-29)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-008/",
      "url": "https://kohasupport.com/advisories/ks-2026-008/",
      "title": "[LOW] KS-2026-008: koha-setup-domains binary missing from all AMIs",
      "summary": "The koha-setup-domains binary is missing from all Koha AMIs due to a configuration oversight.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["low", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-008",
        "severity": "low",
        "status": "fixed",
        "affected_versions": ["Koha AMI builds released before 2026-05-29"],
        "fixed_in": "Koha v25.11.04-1 (AMI build 2026-05-29)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-007/",
      "url": "https://kohasupport.com/advisories/ks-2026-007/",
      "title": "[MEDIUM] KS-2026-007: CloudFormation stack updates fail due to SSM Command document name conflict",
      "summary": "CloudFormation stack updates fail when the SSM Command document is modified.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-28T00:00:00+00:00",
      "tags": ["medium", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-007",
        "severity": "medium",
        "status": "fixed",
        "affected_versions": ["Koha AMI builds released before 2026-05-27"],
        "fixed_in": "AMI build 2026-05-27 (CloudFormation template update)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-006/",
      "url": "https://kohasupport.com/advisories/ks-2026-006/",
      "title": "[HIGH] KS-2026-006: 500 Internal Server Error on AMI upgrade due to password mismatch",
      "summary": "AMI upgrade causes 500 errors due to password mismatch between Plack and MySQL.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["high", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-006",
        "severity": "high",
        "status": "fixed",
        "affected_versions": ["Koha AMI builds released before 2026-05-29"],
        "fixed_in": "Koha v25.11.04-1 (AMI build 2026-05-29)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-005/",
      "url": "https://kohasupport.com/advisories/ks-2026-005/",
      "title": "[MEDIUM] KS-2026-005: Language install fails and OPAC REST API returns 503",
      "summary": "Languages selected during installation are not installed, and the OPAC REST API may return a 503 error.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["medium", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-005",
        "severity": "medium",
        "status": "fixed",
        "affected_versions": ["Koha AMI builds released before 2026-05-29"],
        "fixed_in": "Koha v25.11.04-1 (AMI build 2026-05-29)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-003/",
      "url": "https://kohasupport.com/advisories/ks-2026-003/",
      "title": "[MEDIUM] KS-2026-003: OPACUserCSS system preference is not applied to the OPAC",
      "summary": "Custom CSS set in the OPACUserCSS system preference is not applied to the OPAC.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["medium", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-003",
        "severity": "medium",
        "status": "fixed",
        "affected_versions": ["Koha AMI builds released before 2026-05-29"],
        "fixed_in": "Koha v25.11.04-1 (AMI build 2026-05-29)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-002/",
      "url": "https://kohasupport.com/advisories/ks-2026-002/",
      "title": "[HIGH] KS-2026-002: Password resets fail with 'No such file or directory' error",
      "summary": "Password resets fail with 'env: '/bin/admin/set_password.pl': No such file or directory'.",
      "date_published": "2026-05-28T00:00:00+00:00",
      "date_modified": "2026-05-29T00:00:00+00:00",
      "tags": ["high", "fixed"],
      "_ks_advisory": {
        "id": "KS-2026-002",
        "severity": "high",
        "status": "fixed",
        "affected_versions": ["Koha AMI builds released before 2026-05-29"],
        "fixed_in": "Koha v25.11.04-1 (AMI build 2026-05-29)"
      }
    },
    
    {
      "id": "https://kohasupport.com/advisories/ks-2026-001/",
      "url": "https://kohasupport.com/advisories/ks-2026-001/",
      "title": "[LOW] KS-2026-001: Demonstration Advisory: Advisory Hub Launch",
      "summary": "This is a placeholder advisory published to demonstrate the KohaSupport advisory system. No action is required.",
      "date_published": "2026-05-22T00:00:00+00:00",
      "date_modified": "2026-05-22T00:00:00+00:00",
      "tags": ["low", "closed"],
      "_ks_advisory": {
        "id": "KS-2026-001",
        "severity": "low",
        "status": "closed",
        "affected_versions": ["N/A"],
        "fixed_in": "N/A"
      }
    }
    
  ]
}