Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security vulnerability fixes and multi arch support #763

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+68 −18
Open

Security vulnerability fixes and multi arch support #763

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
56918c8
Security vulnerability fixes and multi arch support
sukalpomitra Jun 7, 2024
427ba22
move the libgnutls30 upgrade command to previous line
sukalpomitra Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/build-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ jobs:
-
name: Checkout
uses: actions/checkout@v2
-
name: Set up QEMU
uses: docker/setup-qemu-action@v2
-
name: Download war artifact
uses: actions/download-artifact@v2
Expand Down Expand Up @@ -79,6 +82,7 @@ jobs:
uses: docker/build-push-action@v2
with:
context: .
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.metadata.outputs.tags }}
labels: ${{ steps.metadata.outputs.labels }}
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ ENV JETTY_VERSION 11.0.20
ENV JETTY_HOME /opt/jetty

# Install packages
RUN apt-get update && \
RUN apt-get update && && apt-get upgrade libgnutls30 -y -q && \
Copy link

@WilliamFromTW WilliamFromTW Jan 19, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. double "&&"
  2. no log when docer logs -f teedy after merge changes

apt-get -y -q --no-install-recommends install \
vim less procps unzip wget tzdata openjdk-11-jdk \
ffmpeg \
Expand Down
11 changes: 8 additions & 3 deletions docs-core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,13 +63,13 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>

<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<artifactId>slf4j-reload4j</artifactId>
jendib marked this conversation as resolved.
Show resolved Hide resolved
</dependency>

<dependency>
Expand Down Expand Up @@ -158,6 +158,11 @@
<artifactId>fr.opensagres.poi.xwpf.converter.pdf</artifactId>
</dependency>

<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
</dependency>

<!-- ImageIO plugins -->
<dependency>
<groupId>com.twelvemonkeys.imageio</groupId>
Expand Down
9 changes: 7 additions & 2 deletions docs-web-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,11 @@
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-json-processing</artifactId>
</dependency>

<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
</dependency>

<!-- Other external dependencies -->
<dependency>
Expand All @@ -49,8 +54,8 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>

<dependency>
Expand Down
9 changes: 7 additions & 2 deletions docs-web/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,11 @@
<groupId>org.glassfish.jersey.inject</groupId>
<artifactId>jersey-hk2</artifactId>
</dependency>

<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
</dependency>

<!-- Other external dependencies -->
<dependency>
Expand All @@ -64,8 +69,8 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>

<dependency>
Expand Down
51 changes: 41 additions & 10 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,19 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<!-- Dependencies version (external) -->
<org.apache.commons.commons-compress.version>1.22</org.apache.commons.commons-compress.version>
<org.apache.commons.commons-compress.version>1.25.0</org.apache.commons.commons-compress.version>
<org.apache.commons.commons-lang3.version>3.12.0</org.apache.commons.commons-lang3.version>
<commons-io.commons-io.version>2.11.0</commons-io.commons-io.version>
<org.apache.commons.commons-email.version>1.5</org.apache.commons.commons-email.version>
<org.freemarker.freemarker.version>2.3.32</org.freemarker.freemarker.version>
<com.google.guava.guava.version>31.1-jre</com.google.guava.guava.version>
<log4j.log4j.version>1.2.17</log4j.log4j.version>
<com.google.guava.guava.version>33.0.0-jre</com.google.guava.guava.version>
<log4j.log4j.version>2.22.1</log4j.log4j.version>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here the log4j version is upgraded to the major version 2, and reload4j is a log4j 1 fork, so there is a problem.

<org.slf4j.version>1.7.30</org.slf4j.version>
<org.slf4j-reload4j.version>2.0.11</org.slf4j-reload4j.version>
<org.slf4j.jcl-over-slf4j.version>1.7.30</org.slf4j.jcl-over-slf4j.version>
<org.slf4j.jul-to-slf4j.version>1.7.30</org.slf4j.jul-to-slf4j.version>
<junit.junit.version>4.13.2</junit.junit.version>
<com.h2database.h2.version>1.4.199</com.h2database.h2.version>
<com.h2database.h2.version>2.2.224</com.h2database.h2.version>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to break all existing instances using h2 database.

Copy link
Contributor Author

@sukalpomitra sukalpomitra Sep 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @jendib we have been working with this version of h2 in our forked teedy without any issues. However let me know and I can revert both this and the log4j version change. But there will still be vulnerabilities for these older versions

<jakarta.json.jakarta.json-api.version>2.1.1</jakarta.json.jakarta.json-api.version>
<at.favre.lib.bcrypt.version>0.10.2</at.favre.lib.bcrypt.version>
<org.apache.lucene.version>8.7.0</org.apache.lucene.version>
Expand All @@ -37,6 +38,7 @@
<joda-time.joda-time.version>2.12.2</joda-time.joda-time.version>
<org.hibernate.hibernate.version>6.3.1.Final</org.hibernate.hibernate.version>
<fr.opensagres.xdocreport.version>2.0.4</fr.opensagres.xdocreport.version>
<xerces.xercesImpl.version>2.12.2</xerces.xercesImpl.version>
<net.java.dev.jna.jna.version>5.13.0</net.java.dev.jna.jna.version>
<com.twelvemonkeys.imageio.version>3.9.4</com.twelvemonkeys.imageio.version>
<com.levigo.jbig2.levigo-jbig2-imageio.version>2.0</com.levigo.jbig2.levigo-jbig2-imageio.version>
Expand All @@ -45,11 +47,12 @@
<org.subethamail.subethasmtp-wiser.version>1.2</org.subethamail.subethasmtp-wiser.version>
<com.icegreen.greenmail.version>1.6.14</com.icegreen.greenmail.version>
<org.jsoup.jsoup.version>1.15.4</org.jsoup.jsoup.version>
<com.squareup.okhttp3.okhttp.version>4.10.0</com.squareup.okhttp3.okhttp.version>
<com.squareup.okhttp3.okhttp.version>4.12.0</com.squareup.okhttp3.okhttp.version>
<org.apache.directory.api.version>2.1.3</org.apache.directory.api.version>
<org.apache.directory.server.apacheds-all.version>2.0.0.AM27</org.apache.directory.server.apacheds-all.version>

<org.glassfish.jersey.version>3.0.10</org.glassfish.jersey.version>
<org.glassfish.jersey.version>3.1.5</org.glassfish.jersey.version>
<parsson.version>1.1.5</parsson.version>
<jakarta.servlet.jakarta.servlet-api.version>5.0.0</jakarta.servlet.jakarta.servlet-api.version>
<org.eclipse.jetty.jetty-server.version>11.0.20</org.eclipse.jetty.jetty-server.version>
<org.eclipse.jetty.jetty-webapp.version>11.0.20</org.eclipse.jetty.jetty-webapp.version>
Expand Down Expand Up @@ -219,15 +222,15 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>${log4j.log4j.version}</version>
</dependency>

<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<version>${org.slf4j.version}</version>
<artifactId>slf4j-reload4j</artifactId>
<version>${org.slf4j-reload4j.version}</version>
</dependency>

<dependency>
Expand Down Expand Up @@ -270,6 +273,12 @@
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-json-processing</artifactId>
<version>${org.glassfish.jersey.version}</version>
<exclusions>
jendib marked this conversation as resolved.
Show resolved Hide resolved
<exclusion>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand Down Expand Up @@ -315,6 +324,12 @@
<version>${org.glassfish.jersey.version}</version>
</dependency>

<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
<version>${parsson.version}</version>
</dependency>

<dependency>
<groupId>jakarta.json</groupId>
<artifactId>jakarta.json-api</artifactId>
Expand Down Expand Up @@ -403,6 +418,12 @@
<groupId>fr.opensagres.xdocreport</groupId>
<artifactId>fr.opensagres.odfdom.converter.pdf</artifactId>
<version>${fr.opensagres.xdocreport.version}</version>
<exclusions>
jendib marked this conversation as resolved.
Show resolved Hide resolved
<exclusion>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand All @@ -411,6 +432,12 @@
<version>${fr.opensagres.xdocreport.version}</version>
</dependency>

<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
<version>${xerces.xercesImpl.version}</version>
</dependency>

<dependency>
<groupId>org.subethamail</groupId>
jendib marked this conversation as resolved.
Show resolved Hide resolved
<artifactId>subethasmtp-wiser</artifactId>
Expand All @@ -420,6 +447,10 @@
<groupId>javax.mail</groupId>
<artifactId>mail</artifactId>
</exclusion>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down