KohaSupport Security Advisories Security and patch advisories for KohaSupport Koha AMI customers on AWS Marketplace. https://kohasupport.com/advisories/ en-us Wed, 08 Jul 2026 05:11:25 +0000 [HIGH] KS-2026-013: Persistent data volume not automatically mounted after AMI upgrade or instance replacement https://kohasupport.com/advisories/ks-2026-013/ https://kohasupport.com/advisories/ks-2026-013/ Fri, 29 May 2026 00:00:00 +0000 Severity: High
Status: Patch pending
Affected: Standard tier AMI builds released before 2026-05-29 (x86_64 and arm64)
Fixed in: Pending AMI release

After an AMI upgrade or Auto Scaling Group instance replacement, the persistent data EBS volume (labeled 'kohadata') is not automatically detected and mounted by the new instance. The instance boots from the new AMI with empty default data, and the customer's library data appears lost until the volume is manually mounted and migrated.

Read full advisory →

]]> [HIGH] KS-2026-012: Stack update may fail with 'SubnetList attribute not found' due to stale CloudFormation cache https://kohasupport.com/advisories/ks-2026-012/ https://kohasupport.com/advisories/ks-2026-012/ Fri, 29 May 2026 00:00:00 +0000 Severity: High
Status: Patch pending
Affected: Standard tier AMI builds released before 2026-05-29 (x86_64 and arm64), Free tier AMI builds released before 2026-05-29
Fixed in: Pending CFN template release

When updating an existing KohaSupport CloudFormation stack to a new AMI version, the stack update may fail with an error referencing a missing SubnetList or AllSubnetsToUse attribute. This is caused by CloudFormation reusing a cached Lambda response from the original stack creation.

Read full advisory →

]]> [MEDIUM] KS-2026-011: S3 backup not configured automatically on first boot when enabled at install time https://kohasupport.com/advisories/ks-2026-011/ https://kohasupport.com/advisories/ks-2026-011/ Fri, 29 May 2026 00:00:00 +0000 Severity: Medium
Status: Patch pending
Affected: Standard tier AMI builds released before 2026-05-29, Enterprise (ARM64) tier AMI builds released before 2026-05-29
Fixed in: Pending AMI release

When S3 backup is enabled during CloudFormation stack creation, the backup timer is silently not configured on first boot. Backups never run despite the option being set.

Read full advisory →

]]> [MEDIUM] KS-2026-004: Koha data volume not encrypted at rest on Standard tier https://kohasupport.com/advisories/ks-2026-004/ https://kohasupport.com/advisories/ks-2026-004/ Fri, 29 May 2026 00:00:00 +0000 Severity: Medium
Status: Fixed
Affected: Koha Cloud Standard Tier AMI builds released before 2026-05-29
Fixed in: Koha v25.11.04-1 (AMI build 2026-05-29)

The Koha data EBS volume on Standard tier instances was not encrypted at rest. New Standard tier stacks launched from the patched AMI use a KMS customer-managed key (CMK) with automatic annual rotation.

Read full advisory →

]]> [LOW] KS-2026-010: OPAC search and menu toggles may fail to load on custom themes https://kohasupport.com/advisories/ks-2026-010/ https://kohasupport.com/advisories/ks-2026-010/ Thu, 28 May 2026 00:00:00 +0000 Severity: Low
Status: Patch pending
Affected: Koha AMI builds released before this patch
Fixed in: Pending AMI release

Custom themes may fail to load essential JavaScript files, breaking search and menu toggles.

Read full advisory →

]]> [LOW] KS-2026-009: Domain setup arguments fail to parse correctly during installation https://kohasupport.com/advisories/ks-2026-009/ https://kohasupport.com/advisories/ks-2026-009/ Thu, 28 May 2026 00:00:00 +0000 Severity: Low
Status: Fixed
Affected: Koha AMI builds released before 2026-05-29
Fixed in: Koha v25.11.04-1 (AMI build 2026-05-29)

Domain setup arguments are not correctly parsed during installation, causing domain configuration to fail.

Read full advisory →

]]> [LOW] KS-2026-008: koha-setup-domains binary missing from all AMIs https://kohasupport.com/advisories/ks-2026-008/ https://kohasupport.com/advisories/ks-2026-008/ Thu, 28 May 2026 00:00:00 +0000 Severity: Low
Status: Fixed
Affected: Koha AMI builds released before 2026-05-29
Fixed in: Koha v25.11.04-1 (AMI build 2026-05-29)

The koha-setup-domains binary is missing from all Koha AMIs due to a configuration oversight.

Read full advisory →

]]> [MEDIUM] KS-2026-007: CloudFormation stack updates fail due to SSM Command document name conflict https://kohasupport.com/advisories/ks-2026-007/ https://kohasupport.com/advisories/ks-2026-007/ Thu, 28 May 2026 00:00:00 +0000 Severity: Medium
Status: Fixed
Affected: Koha AMI builds released before 2026-05-27
Fixed in: AMI build 2026-05-27 (CloudFormation template update)

CloudFormation stack updates fail when the SSM Command document is modified.

Read full advisory →

]]> [HIGH] KS-2026-006: 500 Internal Server Error on AMI upgrade due to password mismatch https://kohasupport.com/advisories/ks-2026-006/ https://kohasupport.com/advisories/ks-2026-006/ Thu, 28 May 2026 00:00:00 +0000 Severity: High
Status: Fixed
Affected: Koha AMI builds released before 2026-05-29
Fixed in: Koha v25.11.04-1 (AMI build 2026-05-29)

AMI upgrade causes 500 errors due to password mismatch between Plack and MySQL.

Read full advisory →

]]> [MEDIUM] KS-2026-005: Language install fails and OPAC REST API returns 503 https://kohasupport.com/advisories/ks-2026-005/ https://kohasupport.com/advisories/ks-2026-005/ Thu, 28 May 2026 00:00:00 +0000 Severity: Medium
Status: Fixed
Affected: Koha AMI builds released before 2026-05-29
Fixed in: Koha v25.11.04-1 (AMI build 2026-05-29)

Languages selected during installation are not installed, and the OPAC REST API may return a 503 error.

Read full advisory →

]]> [MEDIUM] KS-2026-003: OPACUserCSS system preference is not applied to the OPAC https://kohasupport.com/advisories/ks-2026-003/ https://kohasupport.com/advisories/ks-2026-003/ Thu, 28 May 2026 00:00:00 +0000 Severity: Medium
Status: Fixed
Affected: Koha AMI builds released before 2026-05-29
Fixed in: Koha v25.11.04-1 (AMI build 2026-05-29)

Custom CSS set in the OPACUserCSS system preference is not applied to the OPAC.

Read full advisory →

]]> [HIGH] KS-2026-002: Password resets fail with 'No such file or directory' error https://kohasupport.com/advisories/ks-2026-002/ https://kohasupport.com/advisories/ks-2026-002/ Thu, 28 May 2026 00:00:00 +0000 Severity: High
Status: Fixed
Affected: Koha AMI builds released before 2026-05-29
Fixed in: Koha v25.11.04-1 (AMI build 2026-05-29)

Password resets fail with 'env: '/bin/admin/set_password.pl': No such file or directory'.

Read full advisory →

]]> [LOW] KS-2026-001: Demonstration Advisory: Advisory Hub Launch https://kohasupport.com/advisories/ks-2026-001/ https://kohasupport.com/advisories/ks-2026-001/ Fri, 22 May 2026 00:00:00 +0000 Severity: Low
Status: Closed
Affected: N/A

This is a placeholder advisory published to demonstrate the KohaSupport advisory system. No action is required.

Read full advisory →

]]>