Funnelback patch 15.24.0.52

  • Released: 2023-06-21

  • Applies to: v15.24.0

  • Internal reference: FUN-16684, FUN-16723

Description

  • Prevented creation of objects within Freemarker template files to ensure that template editors can not cause external code to be executed.

  • Added new global configuration keys to configure Jetty HTTP connection.

Affected files

  • lib/java/all/admin-api-client-swagger-generated.jar

  • lib/java/all/funnelback-common.jar

  • web/server/funnelback-jetty-launcher.jar

  • web/webapps/funnelback-admin-api.war

  • web/webapps/funnelback-publicui.war

Deployment

  • Stop the Jetty web server.

  • Stop the Daemon service.

  • Deploy the provided files on top of an existing install, backing up all replaced files.

  • (15.24.0.29) It is recommended that the following (empty) files are deleted: lib/java/all/apache-mime4j-core-0.8.2.jar, lib/java/all/apache-mime4j-dom-0.8.2.jar, lib/java/all/asm-6.2.jar, lib/java/all/bcmail-jdk15on-1.60.jar, lib/java/all/bcpkix-jdk15on-1.60.jar, lib/java/all/bcprov-jdk15on-1.60.jar, lib/java/all/c3p0-0.9.1.1.jar, lib/java/all/commons-collections4-4.2.jar, lib/java/all/commons-compress-1.18.jar, lib/java/all/curvesapi-1.04.jar, lib/java/all/cxf-core-3.2.6.jar, lib/java/all/cxf-rt-frontend-jaxrs-3.2.6.jar, lib/java/all/cxf-rt-rs-client-3.2.6.jar, lib/java/all/cxf-rt-transports-http-3.2.6.jar, lib/java/all/FastInfoset-1.2.13.jar, lib/java/all/isoparser-1.1.22.jar, lib/java/all/istack-commons-runtime-3.0.5.jar, lib/java/all/jackcess-2.1.12.jar, lib/java/all/jackcess-encrypt-2.1.4.jar, lib/java/all/jackson-annotations-2.9.6.jar, lib/java/all/java-libpst-0.8.1.jar, lib/java/all/javax.ws.rs-api-2.1.jar, lib/java/all/jaxb-api-2.3.0.jar, lib/java/all/jaxb-core-2.3.0.1.jar, lib/java/all/jaxb-runtime-2.3.0.1.jar, lib/java/all/jbig2-imageio-3.0.2.jar, lib/java/all/jul-to-slf4j-1.7.25.jar, lib/java/all/metadata-extractor-2.11.0.jar, lib/java/all/openjson-1.0.10.jar, lib/java/all/parso-2.0.9.jar, lib/java/all/pdfbox-tools-2.0.12.jar, lib/java/all/poi-4.0.0.jar, lib/java/all/poi-ooxml-4.0.0.jar, lib/java/all/poi-ooxml-schemas-4.0.0.jar, lib/java/all/poi-scratchpad-4.0.0.jar, lib/java/all/protobuf-java-3.8.0.jar, lib/java/all/quartz-2.2.0.jar, lib/java/all/rome-1.5.1.jar, lib/java/all/rome-utils-1.5.1.jar, lib/java/all/sis-feature-0.8.jar, lib/java/all/sis-metadata-0.8.jar, lib/java/all/sis-netcdf-0.8.jar, lib/java/all/sis-referencing-0.8.jar, lib/java/all/sis-storage-0.8.jar, lib/java/all/sis-utility-0.8.jar, lib/java/all/stax2-api-4.1.jar, lib/java/all/stax-ex-1.7.8.jar, lib/java/all/tika-core-1.19.1.jar, lib/java/all/tika-parsers-1.19.1.jar, lib/java/all/txw2-2.3.0.1.jar, lib/java/all/uimafit-core-2.2.0.jar, lib/java/all/uimaj-core-2.9.0.jar, lib/java/all/woodstox-core-5.1.0.jar, lib/java/all/xmlbeans-3.0.1.jar, lib/java/all/xmlschema-core-2.2.3.jar, lib/java/all/xmpcore-5.1.3.jar.

  • (15.24.0.39) It is recommended that the following (empty) file is deleted: lib/java/all/commons-codec-1.9.jar.

  • (15.24.0.45) It is recommended that the following (empty) files are deleted: lib/java/all/log4j-1.2-api-2.6.2.jar, lib/java/all/log4j-api-2.6.2.jar, lib/java/all/log4j-core-2.6.2.jar, lib/java/all/log4j-iostreams-2.6.2.jar, lib/java/all/log4j-jcl-2.6.2.jar, lib/java/all/log4j-jul-2.6.2.jar, lib/java/all/log4j-slf4j-impl-2.6.2.jar, lib/java/all/log4j-web-2.6.2.jar.

  • (15.24.0.48) It is recommended that the following (empty) files are deleted: lib/java/all/google-api-client-1.16.0-rc.jar, lib/java/all/google-api-services-plus-v1-rev86-1.16.0-rc.jar, lib/java/all/google-api-services-youtube-v3-rev120-1.19.0.jar, lib/java/all/google-http-client-1.16.0-rc.jar, lib/java/all/google-http-client-jackson-1.16.0-rc.jar, lib/java/all/google-oauth-client-1.16.0-rc.jar, lib/java/all/jackson-annotations-2.10.3.jar, lib/java/all/jackson-core-2.9.6.jar, lib/java/all/jackson-databind-2.9.6.jar, lib/java/all/jackson-datatype-guava-2.9.6.jar, lib/java/all/jackson-datatype-jdk8-2.9.6.jar, lib/java/all/xpp3-1.1.4c.jar.

  • Start the Jetty web server.

  • Start the Daemon service.

  • (15.24.0.12, 15.24.0.13) Perform an update of knowledge graph on any applicable collections in order to apply patch changes.

  • (15.24.0.25) Update the first line of the bin/delete-collection.pl script to refer to the correct perl interpreter for your Funnelback installation.