Oxalis 5.0.7

[aaron-kumar]

Security fixes:

• Fix critical severity GHSA-h376-j262-vhq6 -> RCE in H2 database Console. CVE: The CVE hasn't been posted by NIST but will be assigned CVE-2021-42392
• Fix high severity GHSA-7rpj-hg47-cx62 -> Improper Restriction of XML External Entity Reference in H2 Database. CVE: CVE-2021-23463

---

This discussion was created from the release Oxalis 5.0.7.

[aaron-kumar]

Main inbound and outbound modules of Oxalis are Not directly using H2 Databases but there are legacy Oxalis modules (oxalis-persistence, oxalis-statistics) which provide H2 database as one of possible database option (apart from HSQL, MySQL, MsSQL, Oracle) to store traffic statistics

If you are using H2 as database to store traffic statistics then before upgrade to this new Oxalis version please refer instructions to perform backup and restore of H2 database since new H2 database is major upgrade with lots of data structure changes.
If you (as H2 database users) Don't want to upgrade to this new version of Oxalis then there is workaround as well in H2 to counter this vulnerability

No action is required, if you are using other databases like HSQL, MySQL, MsSQL and Oracle to store inbound & outbound traffic statistics.

P.S. After upgrading to this new Oxalis version, Oxalis developer have to remove H2 database file/s inside "data" folder of oxalis-persistence, oxalis-statistics modules since H2 database is being used by test-cases and there is incompatibility between new and old H2 database.