# Bishop Fox Security Advisory related to LibreHealth EHR version 2.0.0 **URL:** \ **Category:** EHR\ **Tags:** ehr, security\ **Created:** [July 15, 2020, 5:02am UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757 "2020-07-15T05:02:04Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [July 15, 2020, 5:02am UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/1 "2020-07-15T05:02:05Z")
On March 12, 2020, we were notified by [Bishop Fox](https://bishopfox.com) about a slew of security vulnerabilities they found in [LibreHealth EHR 2.0.0](https://github.com/LibreHealthIO/lh-ehr/releases/tag/REL-2_0_0). A good number of these were high severity vulnerabilities that could have lead to the compromise of the entire server(s) potentially. Internally, we discussed what the next action would be and decided on a plan as to how to get these fixed. Immediately after triaging, it was decided it was a good idea to spin down the demo server for LibreHealth EHR, and it remains in such a state until the fixes are finalized and confirmed to be fixed. We contracted the work of addressing these issues out to two of our former [Outreachy](https://www.outreachy.org) interns, @maggie, and @elizabeth, both of whom got going before the contract was even generated. This was greatly appreciated as the time of the essence. Due to the pandemic, we were given a gracious 30-day extension to the industry standard of 90 days, to 120 days. The [@lsc](https://forums.librehealth.io/groups/lsc) cannot begin to express our gratitude to these two ladies and to @KoniKodes who has advocated for them from the beginning and she is a huge asset to the community. As of this writing, the fixes are almost finished, and we’ll cut a release soon and update Bishop Fox on the patch version. When a patch release is made, we strongly advise all users to update it to that version. In the meantime, please ensure that your system is not publicly accessible on the internet in any way. We would like to thank [Chris Davis](https://labs.bishopfox.com/authors/chris-davis) and Bishop Fox for being accomodating and communicating these to us. You can read Bishop Fox’s full report about their findings below. > **[LibreHealth Version 2.0.0](https://bishopfox.com/blog/librehealth-version-2-0-0-0-advisory)** > > Bishop Fox advisory on five vulnerabilities in LibreHealth application 2.0.0 including SQL injection, cross-site scripting and cross-site request forgery. ---
**Author:** ![rhoyt](https://forums.librehealth.io/user_avatar/forums.librehealth.io/rhoyt/32/93_2.png) [@rhoyt](https://forums.librehealth.io/u/rhoyt)\ **Post date:** [July 15, 2020, 11:03am UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/2 "2020-07-15T11:03:28Z")
@r0bbyThanks. This is obviously very important ---
**Author:** ![KoniKodes](https://forums.librehealth.io/user_avatar/forums.librehealth.io/konikodes/32/701_2.png) [@KoniKodes](https://forums.librehealth.io/u/KoniKodes)\ **Post date:** [July 15, 2020, 4:58pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/3 "2020-07-15T16:58:32Z")
Thank you @r0bby @elizabeth and @maggie have been great at working on this project and keeping us in the loop regarding their updates and pull requests. I am so proud of both of them. ---
**Author:** ![rhoyt](https://forums.librehealth.io/user_avatar/forums.librehealth.io/rhoyt/32/93_2.png) [@rhoyt](https://forums.librehealth.io/u/rhoyt)\ **Post date:** [August 1, 2020, 6:52pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/5 "2020-08-01T18:52:01Z")
@r0bby @sunbiz Do we have a date for when the demo might be available? There is a high school competition org (HOSA) that would like to use the demo for competitions. That also raises the question whether the demo can be used by a group. I know that others (Fatima) are looking for an operational EHR ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [August 3, 2020, 1:15am UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/6 "2020-08-03T01:15:55Z")
> [@rhoyt](#): > > Do we have a date for when the demo might be available? Hey Dr. Hoyt, Hope you are still healthy and remain untouched by this nasty virus going around. The fixes need to be completed and validated before I’m comfortable putting it back online. Once this is done, then I will put it back up, but I cannot put it back online right now as I’d like to be able to sleep. I did the coordination of the fixes and acted as the LibreHealth point of contact, but reached the limit of what I can do unfortunately. ---
**Author:** ![rhoyt](https://forums.librehealth.io/user_avatar/forums.librehealth.io/rhoyt/32/93_2.png) [@rhoyt](https://forums.librehealth.io/u/rhoyt)\ **Post date:** [August 3, 2020, 12:25pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/7 "2020-08-03T12:25:35Z")
@r0bby I understand the issue but wondered if we had a timeline for completion so we can tell people when they can expect access ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [August 3, 2020, 5:56pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/8 "2020-08-03T17:56:28Z")
> [@rhoyt](#): > > I understand the issue but wondered if we had a timeline for completion so we can tell people when they can expect access The ladies are prepping their final report, so soon =) I’ll make announcement when it’s back up. Shouldn’t be more than a month or so, if even that. ---
**Author:** ![rhoyt](https://forums.librehealth.io/user_avatar/forums.librehealth.io/rhoyt/32/93_2.png) [@rhoyt](https://forums.librehealth.io/u/rhoyt)\ **Post date:** [August 18, 2020, 6:28pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/9 "2020-08-18T18:28:36Z")
@r0bby @fmerchant FYI. Dr. Fatima Merchant has asked me to lecture on EHRs to her students on September 22nd. It would be great if we had the demo up and running so I could do a live demonstration ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [August 19, 2020, 12:32am UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/10 "2020-08-19T00:32:17Z")
> [@rhoyt](#): > > FYI. Dr. Fatima Merchant has asked me to lecture on EHRs to her students on September 22nd. It would be great if we had the demo up and running so I could do a live demonstration Should be back up by then. Fixes are complete, just waiting for end to end validation. ---
**Author:** ![rhoyt](https://forums.librehealth.io/user_avatar/forums.librehealth.io/rhoyt/32/93_2.png) [@rhoyt](https://forums.librehealth.io/u/rhoyt)\ **Post date:** [September 22, 2020, 4:23pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/11 "2020-09-22T16:23:06Z")
@r0bby @KoniKodes @sunbiz With no LibreHealth demo I had to use OpenEMR today to lecture the University of Houston ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [September 24, 2020, 6:16pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/12 "2020-09-24T18:16:12Z")
> [@rhoyt](#): > > With no LibreHealth demo I had to use OpenEMR today to lecture the University of Houston I think @sunbiz was going to throw up an instance behind a VPN for you…not sure what’s up. I’d like to get our demo back up ASAP but need all the fixes merged, I’m not a PHP expert. But @mua\_rachmannis doing some great work on finishing up @pri2si17’s prior GSoC work on migrating to laravel, that will eliminate a lot of the issues. I’m waiting for those to be merged, I don’t want to run the demo with vulnerabilities. ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [November 18, 2020, 10:03pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/13 "2020-11-18T22:03:34Z")
Hey @muarachmann, would it be possible to review the remaining PRs for the fixes? If not, it’s okay, just let me know. I’d like to get the ladies paid 😄 . ---
**Author:** ![rhoyt](https://forums.librehealth.io/user_avatar/forums.librehealth.io/rhoyt/32/93_2.png) [@rhoyt](https://forums.librehealth.io/u/rhoyt)\ **Post date:** [January 4, 2021, 2:47pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/14 "2021-01-04T14:47:51Z")
@r0bby @tony @sunbiz I would like to resign my position on the Committee based on many external demands and the fact the demo EHR does not seem to be going anywhere. My best wishes to everyone in 2021 ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [January 4, 2021, 11:33pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/15 "2021-01-04T23:33:02Z")
> [@rhoyt](#): > > I would like to resign my position on the Committee based on many external demands and the fact the demo EHR does not seem to be going anywhere. My best wishes to everyone in 2021 Sorry about the demo, been waiting on @muarachmann – I’m not experienced enough to review the codebase. I did my best to coordinate things and acted as the point of contact between us and Bishop Fox. This is taking longer than I wanted it to, but we’re in the middle of a pandemic, so things are different now. ---
**Author:** ![muarachmann](https://forums.librehealth.io/user_avatar/forums.librehealth.io/muarachmann/32/2291_2.png) [@muarachmann](https://forums.librehealth.io/u/muarachmann)\ **Post date:** [January 8, 2021, 9:07pm UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/16 "2021-01-08T21:07:45Z")
I have had a lot on my plate for the past months. Will schedule a zoom with the ladies and get this done ASAP ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [January 9, 2021, 8:27am UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/17 "2021-01-09T08:27:48Z")
No problem – I understand 100% – do it when you can ---
**Author:** ![r0bby](https://forums.librehealth.io/user_avatar/forums.librehealth.io/r0bby/32/1781_2.png) [@r0bby](https://forums.librehealth.io/u/r0bby)\ **Post date:** [May 6, 2022, 4:46am UTC](https://forums.librehealth.io/t/bishop-fox-security-advisory-related-to-librehealth-ehr-version-2-0-0/3757/18 "2022-05-06T04:46:05Z")
We had another security disclosure: [Multiple vulnerabilities in LibreHealth EHR 2.0.0 – One brick to the IT world](https://murat.one/?p=160) I didn’t do a deep review but suffice to say, we should make a decision on what to do here. I know we are [porting it to Laravel](https://forums.librehealth.io/t/librehealth-ehr-porting-to-laravel-8/3807), so we could link to the new repo in the lh-ehr repo and archive the old one – that’s one option. We should also try to figure out if we want to withdraw or make a notice to not use 2.0.0.