# \#security **URL:** https://talk.openmrs.org/tag/security/173.md [Latest](https://talk.openmrs.org/latest.md) · [Categories](https://talk.openmrs.org/categories.md) · [Tags](https://talk.openmrs.org/tags.md) --- ## [Reminder: Security Squad Call — Monday, 5 October, at 2:00 PM UTC](https://talk.openmrs.org/t/reminder-security-squad-call-monday-5-october-at-2-00-pm-utc/50183)
**Author:** [@beryl](https://talk.openmrs.org/u/beryl)\ **Replies:** 1\ **Last updated:** [October 12, 2026, 8:52am UTC](https://talk.openmrs.org/t/reminder-security-squad-call-monday-5-october-at-2-00-pm-utc/50183 "2026-10-12T08:52:46Z")
Hi everyone, Our next OpenMRS Security Squad call (our newest community squad) will take place on Monday, 5 October 2026, at 2:00 PM UTC (5:00 PM EAT). Everyone interested in OpenMRS security is welcome to join, contri… --- ## [📢 Call for Volunteers: OpenMRS Security Lead (Security Vulnerability Manager)](https://talk.openmrs.org/t/call-for-volunteers-openmrs-security-lead-security-vulnerability-manager/49817)
**Author:** [@beryl](https://talk.openmrs.org/u/beryl)\ **Replies:** 6\ **Last updated:** [August 17, 2026, 12:50pm UTC](https://talk.openmrs.org/t/call-for-volunteers-openmrs-security-lead-security-vulnerability-manager/49817 "2026-08-17T12:50:16Z")
Hi everyone! :waving\_hand: Driven by insights from the \*\*SAFE-OSE project\*\*, OpenMRS is launching a deliberate framework for community members to discover, report, and help fix vulnerabilities. As part of this effort, w… --- ## [Feedback request: InfraScan results for openmrs-cluster](https://talk.openmrs.org/t/feedback-request-infrascan-results-for-openmrs-cluster/49482)
**Author:** [@igor](https://talk.openmrs.org/u/igor)\ **Replies:** 0\ **Last updated:** [May 21, 2026, 10:15am UTC](https://talk.openmrs.org/t/feedback-request-infrascan-results-for-openmrs-cluster/49482 "2026-05-21T10:15:28Z")
Hi everyone, I ran our open-source InfraScan tool against the public infrastructure/config in the OpenMRS cluster repo: Overall score: B (89.3%) Main findings: container vulnerabilities missing encryption/logging-r… --- ## [Community Input Needed: Long-term plan for Security Vulnerability Reporting](https://talk.openmrs.org/t/community-input-needed-long-term-plan-for-security-vulnerability-reporting/48716)
**Author:** [@beryl](https://talk.openmrs.org/u/beryl)\ **Replies:** 1\ **Last updated:** [March 19, 2026, 1:36pm UTC](https://talk.openmrs.org/t/community-input-needed-long-term-plan-for-security-vulnerability-reporting/48716 "2026-03-19T13:36:57Z")
Hi everyone! As part of the NSF project, the squad is currently working on automating our dependency vulnerability checking. Currently, the Security Squad receives the reports, triages them and alerts the community when… --- ## [Announcing the SAFE-OSE Project: Strengthening OpenMRS Security Together](https://talk.openmrs.org/t/announcing-the-safe-ose-project-strengthening-openmrs-security-together/48009)
**Author:** [@burke](https://talk.openmrs.org/u/burke)\ **Replies:** 25\ **Last updated:** [March 5, 2026, 7:18pm UTC](https://talk.openmrs.org/t/announcing-the-safe-ose-project-strengthening-openmrs-security-together/48009 "2026-03-05T19:18:08Z")
We’re excited to announce the launch of SAFE-OSE (Secure Applications For Open-source Ecosystems) – a new 2-year project funded by a grant from the National Science Foundation and carried out as a collaboration between I… --- ## [Standardizing GitHub Actions Workflows for OpenMRS Backend Modules](https://talk.openmrs.org/t/standardizing-github-actions-workflows-for-openmrs-backend-modules/48093)
**Author:** [@wikumc](https://talk.openmrs.org/u/wikumc)\ **Replies:** 0\ **Last updated:** [January 22, 2026, 1:41pm UTC](https://talk.openmrs.org/t/standardizing-github-actions-workflows-for-openmrs-backend-modules/48093 "2026-01-22T13:41:00Z")
Currently, OpenMRS backend modules use a variety of GitHub Actions workflows, and things feel a bit messy. For example, the Billing module follows a setup similar to Core, while other modules each do their own thing. As… --- ## [OpenMRS Critical Security Advisory 2025-05-26](https://talk.openmrs.org/t/openmrs-critical-security-advisory-2025-05-26/46123)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 0\ **Last updated:** [May 26, 2025, 4:23pm UTC](https://talk.openmrs.org/t/openmrs-critical-security-advisory-2025-05-26/46123 "2025-05-26T16:23:01Z")
OpenMRS Security Advisory Please be aware of the following security vulnerability, CVE-2025-46823. Severity: Critical Affected Versions FHIR2 Module versions \< 2.5.0 Vulnerability In versions of the FHIR2 module p… --- ## [Scope of vulnerability CVE-2025-25929 ?](https://talk.openmrs.org/t/scope-of-vulnerability-cve-2025-25929/45422)
**Author:** [@ace](https://talk.openmrs.org/u/ace)\ **Replies:** 2\ **Last updated:** [March 20, 2025, 7:11am UTC](https://talk.openmrs.org/t/scope-of-vulnerability-cve-2025-25929/45422 "2025-03-20T07:11:06Z")
I learned today about vulnerability CVE-2025-25929 (see also CVEs/OpenMRS at main · johnchd/CVEs · GitHub. The report states that /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed is affected. Is only this speci… --- ## [Fantastic Podcast Episode on Phishing Tactics + AI](https://talk.openmrs.org/t/fantastic-podcast-episode-on-phishing-tactics-ai/43866)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 0\ **Last updated:** [October 22, 2024, 1:04am UTC](https://talk.openmrs.org/t/fantastic-podcast-episode-on-phishing-tactics-ai/43866 "2024-10-22T01:04:09Z")
Did you know hackers are combining AI with old-school scam tactics to make phishing more effective than ever? Fantastic podcast came out this weekend on all things Phishing - by my favorite daily CyberSecurity news outle… --- ## [OpenMRS Critical Security Advisory 2025-01-30](https://talk.openmrs.org/t/openmrs-critical-security-advisory-2025-01-30/44797)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 0\ **Last updated:** [January 30, 2025, 2:09pm UTC](https://talk.openmrs.org/t/openmrs-critical-security-advisory-2025-01-30/44797 "2025-01-30T14:09:48Z")
Dear OpenMRS Implementers, We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We’ve released security updates that include c… --- ## [Anyone interested in improving OpenMRS security?](https://talk.openmrs.org/t/anyone-interested-in-improving-openmrs-security/43885)
**Author:** [@jslawinski](https://talk.openmrs.org/u/jslawinski)\ **Replies:** 3\ **Last updated:** [October 28, 2024, 8:31am UTC](https://talk.openmrs.org/t/anyone-interested-in-improving-openmrs-security/43885 "2024-10-28T08:31:58Z")
Digital Square just released and RFA about security improvements. I believe it would be a good fit for OpenMRS. Is there anyone interested in such opportunity? --- ## [Forced Password Changes in O3: Status Update](https://talk.openmrs.org/t/forced-password-changes-in-o3-status-update/43680)
**Author:** [@ibacher](https://talk.openmrs.org/u/ibacher)\ **Replies:** 0\ **Last updated:** [September 27, 2024, 1:22pm UTC](https://talk.openmrs.org/t/forced-password-changes-in-o3-status-update/43680 "2024-09-27T13:22:03Z")
So, as most of you know, both O1 (as we call it now) supported a flow for users to be required to change their passwords the first time they log in. This is a useful system to have in-place, because it allows assurance t… --- ## [Community Plan for Security Improvement](https://talk.openmrs.org/t/community-plan-for-security-improvement/43354)
**Author:** [@caseynth2](https://talk.openmrs.org/u/caseynth2)\ **Replies:** 7\ **Last updated:** [September 26, 2024, 10:40pm UTC](https://talk.openmrs.org/t/community-plan-for-security-improvement/43354 "2024-09-26T22:40:17Z")
Hi all! I have been thinking a lot about security, and wanted to discuss some new initiatives focused on our community approach to security. We need pathway for people who want to work on security issues to have the abil… --- ## [Request for Proposal (RFP)/Quote: Web App and API Penetration Testing](https://talk.openmrs.org/t/request-for-proposal-rfp-quote-web-app-and-api-penetration-testing/41889)
**Author:** [@erica](https://talk.openmrs.org/u/erica)\ **Replies:** 0\ **Last updated:** [February 29, 2024, 7:37am UTC](https://talk.openmrs.org/t/request-for-proposal-rfp-quote-web-app-and-api-penetration-testing/41889 "2024-02-29T07:37:49Z")
Hello! As many would know, OpenMRS is a globally utilized open-source software dedicated to managing medical records in low-resource settings. Our community Reference Application, known as the “RefApp,” is a crucial com… --- ## [TAC Call 2023-07-06: Impressive updates from Raff today :)](https://talk.openmrs.org/t/tac-call-2023-07-06-impressive-updates-from-raff-today/40026)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 0\ **Last updated:** [July 6, 2023, 9:15pm UTC](https://talk.openmrs.org/t/tac-call-2023-07-06-impressive-updates-from-raff-today/40026 "2023-07-06T21:15:08Z")
Dear community, I really enjoyed our TAC call today - despite there being no proposed agenda, @raff shared some really fantastic updates about his latest work that I wanted to share more widely with you all. And ICYMI, … --- ## [TAC Call 2023-06-22: Core library deprecation plan, & support for multiple Reference Ranges for Labs, Vitals](https://talk.openmrs.org/t/tac-call-2023-06-22-core-library-deprecation-plan-support-for-multiple-reference-ranges-for-labs-vitals/39939)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 0\ **Last updated:** [June 22, 2023, 5:45am UTC](https://talk.openmrs.org/t/tac-call-2023-06-22-core-library-deprecation-plan-support-for-multiple-reference-ranges-for-labs-vitals/39939 "2023-06-22T05:45:37Z")
This Thursday’s TAC call will focus on the following prioritized topics: Mitigation Strategy for known unsupported key library How to support multiple Reference ranges for VS, Labs (eg neonates vs pediatrics vs adult… --- ## [How to change password of Bahmni/OpenMRS (and securing the server)](https://talk.openmrs.org/t/how-to-change-password-of-bahmni-openmrs-and-securing-the-server/36707)
**Author:** [@gsluthra](https://talk.openmrs.org/u/gsluthra)\ **Replies:** 9\ **Last updated:** [April 25, 2023, 1:11pm UTC](https://talk.openmrs.org/t/how-to-change-password-of-bahmni-openmrs-and-securing-the-server/36707 "2023-04-25T13:11:37Z")
A lot of users seem to install Bahmni/OpenMRS and don’t change the DEFAULT admin credentials. This is a serious security risk. If you are an ADMIN of any Bahmni server, that is being used in Production / QA / Public exp… --- ## [How to configure OpenMRS user timeout / logout time?](https://talk.openmrs.org/t/how-to-configure-openmrs-user-timeout-logout-time/39438)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 2\ **Last updated:** [April 23, 2023, 1:26pm UTC](https://talk.openmrs.org/t/how-to-configure-openmrs-user-timeout-logout-time/39438 "2023-04-23T13:26:22Z")
Dear Community, A production implementation would like to configure the user timeout / logout time in their OpenMRS3 (O3) instance. (E.g. from 10 minutes to 30 minutes or vice-versa) How can this be done? Is it all abo… --- ## [Google's new OSV-Scanner for vulnerabilities](https://talk.openmrs.org/t/googles-new-osv-scanner-for-vulnerabilities/38252)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 3\ **Last updated:** [January 20, 2023, 11:11am UTC](https://talk.openmrs.org/t/googles-new-osv-scanner-for-vulnerabilities/38252 "2023-01-20T11:11:11Z")
Hey @jayasanka & @dkayiwa - do you think we should leverage this in our dev pipeline somehow? Google Announces Vulnerability Scanner for Open Source Developers | SecurityWeek.Com --- ## [Change 'admin' user's password](https://talk.openmrs.org/t/change-admin-users-password/38250)
**Author:** [@cornelmasson](https://talk.openmrs.org/u/cornelmasson)\ **Replies:** 1\ **Last updated:** [January 6, 2023, 2:31pm UTC](https://talk.openmrs.org/t/change-admin-users-password/38250 "2023-01-06T14:31:20Z")
I installed the Reference Application (v12) with the default password for the ‘admin’ user (‘Admin123’). It’s been a while, so I can’t remember if it prompted me for this password during installation. Two questions: O… --- ## [Great Cybersecurity podcast](https://talk.openmrs.org/t/great-cybersecurity-podcast/37121)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 2\ **Last updated:** [July 29, 2022, 8:53am UTC](https://talk.openmrs.org/t/great-cybersecurity-podcast/37121 "2022-07-29T08:53:58Z")
Hi community, Whether you’re a newb to security like me, or an old hand like @ibacher, I highly recommend this very short ~weekly (sometimes more frequent) podcast CyberSecurity Today from IT World Canada. If you have a … --- ## [\[Announcement\] Patch for Bahmni 0.93 (v0.93.2) is Available](https://talk.openmrs.org/t/announcement-patch-for-bahmni-0-93-v0-93-2-is-available/36875)
**Author:** [@rohit.yawalkar](https://talk.openmrs.org/u/rohit.yawalkar)\ **Replies:** 0\ **Last updated:** [June 13, 2022, 1:44pm UTC](https://talk.openmrs.org/t/announcement-patch-for-bahmni-0-93-v0-93-2-is-available/36875 "2022-06-13T13:44:48Z")
Hello All, Bahmni 0.93.2 patch release is available Things updated This release includes fixing the vulnerabilities with struts-core.jar dependency We have installed the 0.93.2 related changes in the following link f… --- ## [Security Advisory 2022-02-22 (re Path Traversal Vulnerability)](https://talk.openmrs.org/t/security-advisory-2022-02-22-re-path-traversal-vulnerability/35930)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 10:00pm UTC](https://talk.openmrs.org/t/security-advisory-2022-02-22-re-path-traversal-vulnerability/35930 "2022-02-22T22:00:04Z")
OpenMRS Security Notice: Path Traversal Vulnerability CVE-2022-23612 Dear Implementers, Please be aware of the following security vulnerability. Thank you to security researcher Jonathan Leitschuh who discovered the iss… --- ## [URGENT Security Advisory 2021-12-11 (re Apache Log4j 2)](https://talk.openmrs.org/t/urgent-security-advisory-2021-12-11-re-apache-log4j-2/35341)
**Author:** [@grace](https://talk.openmrs.org/u/grace)\ **Replies:** 21\ **Last updated:** [January 31, 2022, 3:36pm UTC](https://talk.openmrs.org/t/urgent-security-advisory-2021-12-11-re-apache-log4j-2/35341 "2022-01-31T15:36:11Z")
Dear Implementers, Please be aware of the following urgent security vulnerability: Severity: Critical & Urgent Affected Versions OpenMRS Platform: v 2.4.0 and v 2.4.1 RefApp: v2.12.0 Exploit A very urgent security i… --- ## [Display Terms and Conditions page in OpenMRS?](https://talk.openmrs.org/t/display-terms-and-conditions-page-in-openmrs/35396)
**Author:** [@ddesimone](https://talk.openmrs.org/u/ddesimone)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 7:09pm UTC](https://talk.openmrs.org/t/display-terms-and-conditions-page-in-openmrs/35396 "2022-01-05T19:09:59Z")
HI, Has anyone built or considered building the display of a Terms and Conditions page in OpenMRS? At PIH we are starting to consider having all users of our production implementations review (and maybe sign) a data us… --- ## [Sonar Integration for Code Quality and Security](https://talk.openmrs.org/t/sonar-integration-for-code-quality-and-security/34789)
**Author:** [@jnsereko](https://talk.openmrs.org/u/jnsereko)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 6:19pm UTC](https://talk.openmrs.org/t/sonar-integration-for-code-quality-and-security/34789 "2021-10-05T18:19:43Z")
Hello all! Brief History Over the past few weeks, I was trying to find a way of automating tests for Cross Site Scripting attacks using RefApp 2.x. Because the system has very many input-fields, it was really tires… --- ## [GSOC 2021 - Security Issues Project - Final Presentation.](https://talk.openmrs.org/t/gsoc-2021-security-issues-project-final-presentation/34460)
**Author:** [@jnsereko](https://talk.openmrs.org/u/jnsereko)\ **Replies:** 1\ **Last updated:** [August 22, 2021, 5:19pm UTC](https://talk.openmrs.org/t/gsoc-2021-security-issues-project-final-presentation/34460 "2021-08-22T17:19:57Z")
Project Title: Security Issues with OpenMRS Primary mentor: @isears Backup mentor: @sharif Student: @jnsereko Reach Me: LinkedIn , Reddit Overview OpenMRS began collaborating with researchers from North Ca… --- ## [java.lang.IllegalStateException: SpringJUnit4ClassRunner requires JUnit 4.12 or higher](https://talk.openmrs.org/t/java-lang-illegalstateexception-springjunit4classrunner-requires-junit-4-12-or-higher/34063)
**Author:** [@jnsereko](https://talk.openmrs.org/u/jnsereko)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 9:31pm UTC](https://talk.openmrs.org/t/java-lang-illegalstateexception-springjunit4classrunner-requires-junit-4-12-or-higher/34063 "2021-07-14T21:31:30Z")
Hello everyone! i am working on an issue in which am trying to prevent attacks through CSRF. I was advised to first implement this in some of the openmrs-modules, there after migrate it to core or any other module. i ha… --- ## [Setting SameSite attribute to Strict](https://talk.openmrs.org/t/setting-samesite-attribute-to-strict/33777)
**Author:** [@jnsereko](https://talk.openmrs.org/u/jnsereko)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 5:54pm UTC](https://talk.openmrs.org/t/setting-samesite-attribute-to-strict/33777 "2021-06-15T17:54:25Z")
Hello everyone! Late last week i have been working on how to make Cookies more secure in OpenMRS and i have been able to send a pull request. I was advised to set the SameSite attribute to strict because it will protect… --- ## [Suggestions and Tips for securing Bahmni Server](https://talk.openmrs.org/t/suggestions-and-tips-for-securing-bahmni-server/33141)
**Author:** [@gsluthra](https://talk.openmrs.org/u/gsluthra)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 9:40am UTC](https://talk.openmrs.org/t/suggestions-and-tips-for-securing-bahmni-server/33141 "2021-06-15T09:40:54Z")
As you all are aware, Bahmni / OpenMRS servers store PII and Clinical/Health Data – and need to be secured from manipulation, modification, data corruption, outages, hack, malware, etc. The Bahmni documentation mentioned… [Next page](https://talk.openmrs.org/tag/security/173.md?match_all_tags=true&page=1&tags%5B%5D=security)