Help Center

Menu

Funnelback patch 16.10.0.1

  • Released: 2022-05-13

  • Applies to: v16.10.0

  • Internal reference: RNDSUPPORT-3497

Description

  • Fixed the security vulnerabilities where com.google.oauth-client hasn’t implemented PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps.

Affected files

  • lib/java/all/funnelback-social-media.jar

  • lib/java/all/google-api-client-1.16.0-rc.jar: (replaced with empty jar file)

  • lib/java/all/google-api-client-1.34.0.jar

  • lib/java/all/google-api-services-plus-v1-rev86-1.16.0-rc.jar: (replaced with empty jar file)

  • lib/java/all/google-api-services-youtube-v3-rev120-1.19.0.jar: (replaced with empty jar file)

  • lib/java/all/google-api-services-youtube-v3-rev20220418-1.32.1.jar

  • lib/java/all/google-http-client-1.16.0-rc.jar: (replaced with empty jar file)

  • lib/java/all/google-http-client-1.41.8.jar

  • lib/java/all/google-http-client-apache-v2-1.41.7.jar

  • lib/java/all/google-http-client-gson-1.41.7.jar

  • lib/java/all/google-http-client-jackson-1.16.0-rc.jar: (replaced with empty jar file)

  • lib/java/all/google-http-client-jackson2-1.41.8.jar

  • lib/java/all/google-oauth-client-1.16.0-rc.jar: (replaced with empty jar file)

  • lib/java/all/google-oauth-client-1.33.2.jar

  • lib/java/all/grpc-context-1.27.2.jar

  • lib/java/all/j2objc-annotations-1.3.jar

  • lib/java/all/jackson-databind-2.13.2.1.jar: (replaced with empty jar file)

  • lib/java/all/jackson-databind-2.13.2.2.jar

  • lib/java/all/opencensus-api-0.31.0.jar

  • lib/java/all/opencensus-contrib-http-util-0.31.0.jar

  • lib/java/all/xpp3-1.1.4c.jar: (replaced with empty jar file)

  • web/webapps/cortex-rest-api.war

  • web/webapps/funnelback-admin-api.war

  • web/webapps/funnelback-classic-admin.war

  • web/webapps/funnelback-mediator-endpoint-http.war

  • web/webapps/funnelback-publicui.war

  • web/webapps/funnelback-push-api.war

Deployment

  • Stop the Jetty web server.

  • Deploy the provided files on top of an existing install, backing up all replaced files.

  • (16.10.0.1) It is recommended that the following (empty) files are deleted: lib/java/all/google-api-client-1.16.0-rc.jar, lib/java/all/google-api-services-plus-v1-rev86-1.16.0-rc.jar, lib/java/all/google-api-services-youtube-v3-rev120-1.19.0.jar, lib/java/all/google-http-client-1.16.0-rc.jar, lib/java/all/google-http-client-jackson-1.16.0-rc.jar, lib/java/all/google-oauth-client-1.16.0-rc.jar, lib/java/all/jackson-databind-2.13.2.1.jar, lib/java/all/xpp3-1.1.4c.jar.

  • Start the Jetty web server.