BlueSpice Helpdesk - User contributions [en]

Security:Security Advisories/BSSA-2026-05

2026-07-21T11:41:13Z

Zhayat: Added CVE-2025-65896

{| class="wikitable"
|+
!
!
|-
|Date
|2026-07-17
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected'''
|-
|Affected
|<code>bluespice/search</code> Docker image (all versions)
<code>bluespice/ai</code> Docker image (5.3.x)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2025-14813 CVE-2025-14813]
* [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2025-14813
|<code>bluespice/search</code>
|Use of a Broken or Risky Cryptographic Algorithm
| style="" class="col-green-bg" |not affected
|-
|CVE-2025-65896
|<code>bluespice/ai</code>
|SQL Injection via dictionary as params
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14813
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
|CVE-2025-65896
| style="" class="col-green-bg" |Asyncmy is only used as the DB API layer for SQLAlchemy to connect to MySQL, SQLAlchemy enforces a "format" parameter style, which only uses "%s" placeholder strings for SQL queries. This is opposed to inserting values via a dictionary, meaning no impact from this CVE is possible.
|No action required.
|}

== Solution ==
No immediate action required.

Setup:Installation Guide/Docker/Pro and Farm edition

2025-10-15T12:56:35Z

Zhayat: Fixed typo

Almost all container images used by the stack are freely available via hub.docker.com. The only exception is <code>bluespice/wiki</code> with the PRO / FARM codebase. There are two options to obtain this image:

# Manual download from [https://bluespice.com/download/ bluespice.com] and local import
# Load from private <code>docker.bluespice.com</code> image registry

== Manual download and import ==
Before running <code>bluespice-deploy</code> you will need to download the <code>docker.bluespice.com/bluespice-[pro|farm]/wiki</code> image from https://bluespice.com/download/ and store the file to the server (e.g. in <code>/tmp/docker.bluespice.com_bluespice-pro_wiki_5.1.0.tar.gz</code> ).

Then you can use the standard <code>docker load</code> command to make it available to the docker runtime.

Example:
docker load < /tmp/docker.bluespice.com_bluespice-pro_wiki_5.1.0.tar.gz
# Loaded image: docker.bluespice.com/bluespice-pro/wiki:5.1.0
bluespice-deyploy up -d
# Image found locally.

== Load from <code>docker.bluespice.com</code> ==

If you have credentials to <code>docker.bluespice.com</code> you can just run <code>bluespice-deyploy up -d</code> . It will prompt you for username and password in case you haven't configured it already.

Example:

bluespice-deploy up -d
# In order to access our PRO-Image please login to docker.bluespice.com
username: myuser
password:

[[de:Setup:Installationsanleitung/Docker/Pro_und_Farm_Edition]]

User:Zhayat

2025-10-10T07:01:36Z

Zhayat: create user page

User blog:Zhayat

2025-10-10T07:01:36Z

Zhayat: Root blog page created