Skip to content

Upgrades commons libraries to fix security vulnerabilities #219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NicoPiel wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Upgrades commons libraries to fix security vulnerabilities #219

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c25905c
Upgrades commons libraries
NicoPiel Dec 5, 2025
aa637d2
Bumps bundled dependency versions in manifests
NicoPiel Dec 5, 2025
d86b26b
Bumps commons in generator
NicoPiel Dec 5, 2025
0b39e6a
Updates commons libraries to newer versions (donkey/cli)
NicoPiel Dec 6, 2025
b2d6f57
Re-added beanutils to CLI
NicoPiel Dec 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions client/.classpath
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@
<classpathentry kind="lib" path="lib/looks-2.3.1.jar"/>
<classpathentry kind="lib" path="lib/xercesImpl-2.12.2.jar"/>
<classpathentry kind="lib" path="lib/commons-io-2.13.0.jar"/>
<classpathentry kind="lib" path="lib/commons-lang3-3.13.0.jar">
<classpathentry kind="lib" path="lib/commons-lang3-3.18.0.jar">
<attributes>
<attribute name="javadoc_location" value="http://commons.apache.org/lang/api/"/>
</attributes>
Expand All @@ -141,10 +141,10 @@
<classpathentry kind="lib" path="/Server/setup/client-lib/userutil-sources.jar"/>
<classpathentry kind="lib" path="lib/miglayout-swing-4.2.jar"/>
<classpathentry kind="lib" path="lib/miglayout-core-4.2.jar"/>
<classpathentry kind="lib" path="lib/commons-beanutils-1.9.4.jar"/>
<classpathentry kind="lib" path="lib/commons-beanutils-1.11.0.jar"/>
<classpathentry kind="lib" path="lib/velocity-engine-core-2.3.jar"/>
<classpathentry kind="lib" path="lib/velocity-tools-generic-3.1.jar"/>
<classpathentry kind="lib" path="lib/commons-configuration2-2.8.0.jar"/>
<classpathentry kind="lib" path="lib/commons-configuration2-2.10.1.jar"/>
<classpathentry kind="lib" path="lib/javax.mail-1.5.0.jar"/>
<classpathentry kind="lib" path="lib/rsyntaxtextarea-2.5.6.jar"/>
<classpathentry kind="lib" path="lib/autocomplete-2.5.4.jar"/>
Expand Down
Binary file added client/lib/commons-beanutils-1.11.0.jar
View file
Open in desktop
Copy link
Member

@tonygermano tonygermano Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is the changelog for commons-beanutils https://commons.apache.org/proper/commons-beanutils/changes.html

I don't see anything concerning there.

In the pom it has dependencies on

  • commons-logging 1.3.5 (we are currently on 1.2)
  • commons-collections 3.2.2 (we are good on this one.)

This is the changelog for commons-logging https://commons.apache.org/proper/commons-logging/changes.html

commons-logging has a dependency on log4j 2.24.3 (we are on 2.17.2)

Binary file not shown.
Binary file removed client/lib/commons-beanutils-1.9.4.jar
View file
Open in desktop
Binary file not shown.
Binary file added client/lib/commons-configuration2-2.10.1.jar
View file
Open in desktop
Copy link
Member

@tonygermano tonygermano Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is the changelog for commons-configuration https://commons.apache.org/proper/commons-configuration/changes.html

This PR only bumps to 2.10.1, but 2.13.0 is available.

In the pom it has dependencies on

  • commons-logging 1.3.0
    • we are currently on 1.2
    • This is lower than the 1.3.5 required by beanutils
    • commons-configuration2-2.13.0 requires 1.3.5
  • commons-text 1.11.0
    • we are currently on 1.10.0
    • 1.15.0 is available
    • commons-configuration2-2.13.0 requires 1.14.0
  • commons-lang3 3.14.0
    • this PR already upgrades to 3.18.0
    • 3.20.0 is available
    • commons-configuration2-2.13.0 requires 3.20.0
  • log4j 2.23.1
    • we are on 2.17.2
    • the commons-logging version required by beanutils requires 2.24.3
    • 2.25.2 is available
    • commons-configuration2-2.13.0 requires 2.25.2

These are optional dependencies that we have in our classpath, but I don't know that we're actually using them with commons-configuration

  • jackson-databind 2.17.0
    • we are on jackson 2.14.3
    • the 2.x releases go up to 2.20.1
    • commons-configuration2-2.13.0 requires 2.20.1
  • commons-codec 1.16.1
    • we are on 1.16.0
    • 1.20.0 is available
    • commons-configuration2-2.13.0 requires1.20.0

Binary file not shown.
Binary file removed client/lib/commons-configuration2-2.8.0.jar
View file
Open in desktop
Binary file not shown.
Binary file removed client/lib/commons-lang3-3.13.0.jar
View file
Open in desktop
Binary file not shown.
Binary file added client/lib/commons-lang3-3.18.0.jar
View file
Open in desktop
Copy link
Member

@tonygermano tonygermano Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here's the changelog for commons-lang3 https://commons.apache.org/proper/commons-lang/changes.html

Is there a reason you stopped at 3.18.0 rather than going all the way to 3.20.0?

Copy link
Collaborator Author

@NicoPiel NicoPiel Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because that is what #218 suggested.

Copy link
Member

@tonygermano tonygermano Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I missed that it was linked to an issue that recommended specific versions.

Binary file not shown.
2 changes: 1 addition & 1 deletion command/.classpath
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
<attribute name="javadoc_location" value="http://commons.apache.org/cli/api-release/"/>
</attributes>
</classpathentry>
<classpathentry kind="lib" path="lib/commons-lang3-3.13.0.jar"/>
<classpathentry kind="lib" path="lib/commons-lang3-3.18.0.jar"/>
<classpathentry kind="lib" path="lib/commons-logging-1.2.jar">
<attributes>
<attribute name="javadoc_location" value="http://commons.apache.org/logging/apidocs/"/>
Expand Down
Binary file removed command/lib/commons-beanutils-1.9.4.jar
View file
Open in desktop
Binary file not shown.
Binary file added command/lib/commons-configuration2-2.10.1.jar
View file
Open in desktop
Binary file not shown.
Binary file removed command/lib/commons-configuration2-2.8.0.jar
View file
Open in desktop
Binary file not shown.
Binary file removed command/lib/commons-lang3-3.13.0.jar
View file
Open in desktop
Binary file not shown.
Binary file added command/lib/commons-lang3-3.18.0.jar
View file
Open in desktop
Binary file not shown.
2 changes: 1 addition & 1 deletion generator/.classpath
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
<attribute name="javadoc_location" value="https://logging.apache.org/log4j/2.x/log4j-core/apidocs/"/>
</attributes>
</classpathentry>
<classpathentry kind="lib" path="lib/commons-lang3-3.13.0.jar"/>
<classpathentry kind="lib" path="lib/commons-lang3-3.18.0.jar"/>
<classpathentry kind="lib" path="lib/commons-io-2.13.0.jar"/>
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/>
<classpathentry kind="output" path="bin"/>
Expand Down
Binary file removed generator/lib/commons-lang3-3.13.0.jar
View file
Open in desktop
Binary file not shown.
Binary file added generator/lib/commons-lang3-3.18.0.jar
View file
Open in desktop
Binary file not shown.
6 changes: 3 additions & 3 deletions manager/.classpath
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,8 @@
</classpathentry>
<classpathentry kind="lib" path="lib/looks-2.3.1.jar"/>
<classpathentry kind="lib" path="lib/commons-io-2.13.0.jar"/>
<classpathentry kind="lib" path="lib/commons-configuration2-2.8.0.jar"/>
<classpathentry kind="lib" path="lib/commons-lang3-3.13.0.jar"/>
<classpathentry kind="lib" path="lib/commons-configuration2-2.10.1.jar"/>
<classpathentry kind="lib" path="lib/commons-lang3-3.18.0.jar"/>
<classpathentry kind="lib" path="lib/commons-collections4-4.4.jar"/>
<classpathentry combineaccessrules="false" kind="src" path="/Donkey">
<accessrules>
Expand All @@ -46,7 +46,7 @@
<classpathentry kind="lib" path="lib/commons-codec-1.16.0.jar"/>
<classpathentry kind="lib" path="lib/httpcore-4.4.13.jar"/>
<classpathentry kind="lib" path="lib/commons-text-1.10.0.jar"/>
<classpathentry kind="lib" path="lib/commons-beanutils-1.9.4.jar"/>
<classpathentry kind="lib" path="lib/commons-beanutils-1.11.0.jar"/>
<classpathentry kind="lib" path="lib/httpclient-4.5.13.jar"/>
<classpathentry kind="lib" path="lib/httpmime-4.5.13.jar"/>
<classpathentry kind="lib" path="lib/rhino-1.7.13.jar"/>
Expand Down
2 changes: 1 addition & 1 deletion manager/ant-build.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
<manifest>
<attribute name="Manifest-Version" value="1.0" />
<attribute name="Main-Class" value="com.mirth.connect.manager.Manager" />
<attribute name="Class-Path" value="manager-lib/miglayout-core-4.2.jar manager-lib/miglayout-swing-4.2.jar manager-lib/swingx-core-1.6.2.jar manager-lib/looks-2.3.1.jar manager-lib/commons-beanutils-1.9.4.jar manager-lib/commons-codec-1.16.0.jar manager-lib/commons-collections4-4.4.jar manager-lib/commons-configuration2-2.8.0.jar manager-lib/httpclient-4.5.13.jar manager-lib/httpcore-4.4.13.jar manager-lib/httpmime-4.5.13.jar manager-lib/commons-lang3-3.13.0.jar manager-lib/commons-logging-1.2.jar manager-lib/commons-io-2.13.0.jar manager-lib/commons-text-1.10.0.jar manager-lib/log4j-1.2-api-2.17.2.jar manager-lib/log4j-api-2.17.2.jar manager-lib/log4j-core-2.17.2.jar manager-lib/xpp3-1.1.4c.jar manager-lib/xstream-1.4.20.jar manager-lib/mirth-client-core.jar manager-lib/mirth-crypto.jar manager-lib/donkey-model.jar manager-lib/javassist-3.26.0-GA.jar manager-lib/guava-28.2-jre.jar manager-lib/javax.annotation-api-1.3.2.jar manager-lib/javax.inject-2.4.0-b31.jar manager-lib/javax.ws.rs-api-2.0.1.jar manager-lib/jersey-client-2.22.1.jar manager-lib/jersey-common-2.22.1.jar manager-lib/jersey-guava-2.22.1.jar manager-lib/jersey-media-multipart-2.22.1.jar manager-lib/jersey-proxy-client-2.22.1.jar manager-lib/hk2-api-2.4.0-b31.jar manager-lib/hk2-locator-2.4.0-b31.jar manager-lib/hk2-utils-2.4.0-b31.jar manager-lib/mimepull-1.9.7.jar manager-lib/swagger-annotations-2.0.10.jar manager-lib/reflections-0.9.10.jar manager-lib/rhino-1.7.13.jar" />
<attribute name="Class-Path" value="manager-lib/miglayout-core-4.2.jar manager-lib/miglayout-swing-4.2.jar manager-lib/swingx-core-1.6.2.jar manager-lib/looks-2.3.1.jar manager-lib/commons-beanutils-1.11.0.jar manager-lib/commons-codec-1.16.0.jar manager-lib/commons-collections4-4.4.jar manager-lib/commons-configuration2-2.10.1.jar manager-lib/httpclient-4.5.13.jar manager-lib/httpcore-4.4.13.jar manager-lib/httpmime-4.5.13.jar manager-lib/commons-lang3-3.18.0.jar manager-lib/commons-logging-1.2.jar manager-lib/commons-io-2.13.0.jar manager-lib/commons-text-1.10.0.jar manager-lib/log4j-1.2-api-2.17.2.jar manager-lib/log4j-api-2.17.2.jar manager-lib/log4j-core-2.17.2.jar manager-lib/xpp3-1.1.4c.jar manager-lib/xstream-1.4.20.jar manager-lib/mirth-client-core.jar manager-lib/mirth-crypto.jar manager-lib/donkey-model.jar manager-lib/javassist-3.26.0-GA.jar manager-lib/guava-28.2-jre.jar manager-lib/javax.annotation-api-1.3.2.jar manager-lib/javax.inject-2.4.0-b31.jar manager-lib/javax.ws.rs-api-2.0.1.jar manager-lib/jersey-client-2.22.1.jar manager-lib/jersey-common-2.22.1.jar manager-lib/jersey-guava-2.22.1.jar manager-lib/jersey-media-multipart-2.22.1.jar manager-lib/jersey-proxy-client-2.22.1.jar manager-lib/hk2-api-2.4.0-b31.jar manager-lib/hk2-locator-2.4.0-b31.jar manager-lib/hk2-utils-2.4.0-b31.jar manager-lib/mimepull-1.9.7.jar manager-lib/swagger-annotations-2.0.10.jar manager-lib/reflections-0.9.10.jar manager-lib/rhino-1.7.13.jar" />
</manifest>
</jar>
</target>
Expand Down
Binary file added manager/lib/commons-beanutils-1.11.0.jar
View file
Open in desktop
Binary file not shown.
Binary file removed manager/lib/commons-beanutils-1.9.4.jar
View file
Open in desktop
Binary file not shown.
Binary file added manager/lib/commons-configuration2-2.10.1.jar
View file
Open in desktop
Binary file not shown.
Binary file removed manager/lib/commons-configuration2-2.8.0.jar
View file
Open in desktop
Binary file not shown.
Binary file removed manager/lib/commons-lang3-3.13.0.jar
View file
Open in desktop
Binary file not shown.
Binary file added manager/lib/commons-lang3-3.18.0.jar
View file
Open in desktop
Binary file not shown.
6 changes: 3 additions & 3 deletions server/.classpath
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@
<classpathentry kind="lib" path="lib/extensions/file/jcifs-ng-2.1.10.jar"/>
<classpathentry kind="lib" path="lib/extensions/doc/itext-2.1.7.jar"/>
<classpathentry kind="lib" path="lib/extensions/doc/itext-rtf-2.1.7.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-beanutils-1.9.4.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-beanutils-1.11.0.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-cli-1.2.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-configuration2-2.8.0.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-configuration2-2.10.1.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-dbcp2-2.0.1.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-dbutils-1.7.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-digester3-3.2.jar"/>
Expand Down Expand Up @@ -46,7 +46,7 @@
<classpathentry kind="lib" path="lib/extensions/dimse/dcm4che-tool-dcmrcv-2.0.29.jar"/>
<classpathentry kind="lib" path="lib/extensions/dimse/dcm4che-tool-dcmsnd-2.0.29.jar"/>
<classpathentry kind="lib" path="lib/mybatis-3.1.1.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-lang3-3.13.0.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-lang3-3.18.0.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-io-2.13.0.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-math3-3.0.jar"/>
<classpathentry kind="lib" path="lib/commons/commons-text-1.10.0.jar"/>
Expand Down
2 changes: 1 addition & 1 deletion server/build.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1036,7 +1036,7 @@

<manifest>
<attribute name="Main-Class" value="com.mirth.connect.server.launcher.MirthLauncher" />
<attribute name="Class-Path" value="server-lib/commons/commons-io-2.13.0.jar server-lib/commons/commons-configuration2-2.8.0.jar server-lib/commons/commons-lang3-3.13.0.jar server-lib/commons/commons-logging-1.2.jar server-lib/commons/commons-beanutils-1.9.4.jar server-lib/commons/commons-text-1.10.0.jar server-lib/commons/commons-collections-3.2.2.jar conf/" />
<attribute name="Class-Path" value="server-lib/commons/commons-io-2.13.0.jar server-lib/commons/commons-configuration2-2.10.1.jar server-lib/commons/commons-lang3-3.18.0.jar server-lib/commons/commons-logging-1.2.jar server-lib/commons/commons-beanutils-1.11.0.jar server-lib/commons/commons-text-1.10.0.jar server-lib/commons/commons-collections-3.2.2.jar conf/" />
</manifest>
</jar>

Expand Down
Binary file added server/lib/commons/commons-beanutils-1.11.0.jar
View file
Open in desktop
Binary file not shown.
Binary file removed server/lib/commons/commons-beanutils-1.9.4.jar
View file
Open in desktop
Binary file not shown.
Binary file added server/lib/commons/commons-configuration2-2.10.1.jar
View file
Open in desktop
Binary file not shown.
Binary file removed server/lib/commons/commons-configuration2-2.8.0.jar
View file
Open in desktop
Binary file not shown.
Binary file removed server/lib/commons/commons-lang3-3.13.0.jar
View file
Open in desktop
Binary file not shown.
Binary file added server/lib/commons/commons-lang3-3.18.0.jar
View file
Open in desktop
Binary file not shown.