Skip to content

Commit acb2100

Browse files
offtherailzofftherailz
authored
Mapstore log4j fixes update on stable branch (#7666)
1 parent b67aed7 commit acb2100

File tree

10 files changed

+100
-20
lines changed

10 files changed

+100
-20
lines changed

‎docs/developer-guide/mapstore-migration-guide.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,74 @@ This is a list of things to check if you want to update from a previous version
2020
- Optionally check also accessory files like `.eslinrc`, if you want to keep aligned with lint standards.
2121
- Follow the instructions below, in order, from your version to the one you want to update to.
2222

23+
## Migration from 2021.02.00 to 2021.02.01
24+
25+
This update contains a fix for a minor vulnerability found in `log4j` library.
26+
For this reason you may need to update the dependencies of your project
27+
28+
!!! note
29+
This vulnerability **is not** [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228)
30+
but only a couple of smaller ones, that involve `Log4J` ( [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) is for `Log4J2` ).
31+
Anyway MapStore is not prone to these vulnerabilities with the default configuration.
32+
For more information, see the dedicated [blog post](https://www.geosolutionsgroup.com/blog/geosolutions-lo4shell/)
33+
34+
here the instructions:
35+
36+
### Align `pom.xml` files
37+
38+
Here the changes in `pom.xml` and `web/pom.xml` to update:
39+
40+
- Change `mapstore-backend` into `mapstore-services` and set the version to `1.2.2`
41+
42+
```diff
43+
<!-- MapStore backend -->
44+
<dependency>
45+
<groupId>it.geosolutions.mapstore</groupId>
46+
- <artifactId>mapstore-backend</artifactId>
47+
- <version>1.2.1</version>
48+
+ <artifactId>mapstore-services</artifactId>
49+
+ <version>1.2.2</version>
50+
</dependency>
51+
```
52+
53+
- Set `geostore-webapp` version to `1.7.1`
54+
55+
```diff
56+
<dependency>
57+
<groupId>it.geosolutions.geostore</groupId>
58+
<artifactId>geostore-webapp</artifactId>
59+
- <version>1.7.0</version>
60+
+ <version>1.7.1</version>
61+
<type>war</type>
62+
<scope>runtime</scope>
63+
</dependency>
64+
```
65+
66+
- Set `http_proxy` version to `1.1.1` (should already be there)
67+
68+
```diff
69+
<dependency>
70+
<!-- ... -->
71+
<groupId>proxy</groupId>
72+
<artifactId>http_proxy</artifactId>
73+
- <version>1.1.0</version>
74+
+ <version>1.1.1</version>
75+
<type>war</type>
76+
<scope>runtime</scope>
77+
</dependency>
78+
```
79+
80+
- Set `print-lib` version `geosolutions-2.0` to version `geosolutions-2.0.1`
81+
82+
```diff
83+
<dependency>
84+
<groupId>org.mapfish.print</groupId>
85+
<artifactId>print-lib</artifactId>
86+
- <version>geosolutions-2.0</version>
87+
+ <version>geosolutions-2.0.1</version>
88+
</dependency>
89+
```
90+
2391
## Migration from 2021.01.04 to 2021.02.00
2492

2593
### Theme updates and CSS variables

‎java/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<groupId>it.geosolutions.mapstore</groupId>
55
<artifactId>mapstore-java</artifactId>
66
<packaging>pom</packaging>
7-
<version>1.2.1</version>
7+
<version>1.2-SNAPSHOT</version>
88
<name>MapStore 2</name>
99
<url>http://www.geo-solutions.it</url>
1010

‎java/printing/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<groupId>it.geosolutions.mapstore</groupId>
55
<artifactId>mapstore-print</artifactId>
66
<packaging>pom</packaging>
7-
<version>1.2.1</version>
7+
<version>1.2-SNAPSHOT</version>
88
<name>MapStore 2 - Printing extension bundle</name>
99
<url>http://www.geo-solutions.it</url>
1010

@@ -18,7 +18,7 @@
1818
<dependency>
1919
<groupId>org.mapfish.print</groupId>
2020
<artifactId>print-lib</artifactId>
21-
<version>geosolutions-2.0</version>
21+
<version>geosolutions-2.0.1</version>
2222
</dependency>
2323
</dependencies>
2424

‎java/services/pom.xml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<groupId>it.geosolutions.mapstore</groupId>
55
<artifactId>mapstore-services</artifactId>
66
<packaging>jar</packaging>
7-
<version>1.2.1</version>
7+
<version>1.2-SNAPSHOT</version>
88
<name>MapStore 2 - Backend Services</name>
99
<url>http://www.geo-solutions.it</url>
1010

@@ -26,7 +26,19 @@
2626
<groupId>eu.medsea.mimeutil</groupId>
2727
<artifactId>mime-util</artifactId>
2828
<version>2.1.3</version>
29+
<exclusions>
30+
<exclusion>
31+
<groupId>log4j</groupId>
32+
<artifactId>log4j</artifactId>
33+
</exclusion>
34+
</exclusions>
2935
</dependency>
36+
<dependency>
37+
<groupId>log4j</groupId>
38+
<artifactId>log4j</artifactId>
39+
<version>1.2.17.norce</version>
40+
</dependency>
41+
<!-- Replace log4j coming from mimeutil with the secure one-->
3042

3143
<!-- Spring -->
3244
<!-- https://mvnrepository.com/artifact/org.springframework/spring-webmvc -->

‎java/web/pom.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<groupId>it.geosolutions.mapstore</groupId>
55
<artifactId>mapstore-webapp</artifactId>
66
<packaging>war</packaging>
7-
<version>1.2.1</version>
7+
<version>1.2-SNAPSHOT</version>
88
<name>MapStore 2 - WAR</name>
99
<url>http://www.geo-solutions.it</url>
1010

@@ -19,7 +19,7 @@
1919
<dependency>
2020
<groupId>it.geosolutions.mapstore</groupId>
2121
<artifactId>mapstore-services</artifactId>
22-
<version>1.2.1</version>
22+
<version>1.2-SNAPSHOT</version>
2323
</dependency>
2424

2525
<!-- ================================================================ -->
@@ -28,14 +28,14 @@
2828
<dependency>
2929
<groupId>it.geosolutions.geostore</groupId>
3030
<artifactId>geostore-webapp</artifactId>
31-
<version>1.7.0</version>
31+
<version>1.7.1</version>
3232
<type>war</type>
3333
<scope>runtime</scope>
3434
</dependency>
3535
<dependency>
3636
<groupId>proxy</groupId>
3737
<artifactId>http_proxy</artifactId>
38-
<version>1.1.0</version>
38+
<version>1.1.1</version>
3939
<type>war</type>
4040
<scope>runtime</scope>
4141
</dependency>

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<groupId>it.geosolutions.mapstore</groupId>
55
<artifactId>mapstore-root</artifactId>
66
<packaging>pom</packaging>
7-
<version>1.2.1</version>
7+
<version>1.2-SNAPSHOT</version>
88
<name>MapStore Root</name>
99

1010
<properties>

‎product/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<groupId>it.geosolutions.mapstore</groupId>
55
<artifactId>mapstore-product</artifactId>
66
<packaging>war</packaging>
7-
<version>1.2.1</version>
7+
<version>1.2-SNAPSHOT</version>
88
<name>MapStore Product Web Application</name>
99

1010
<properties>
@@ -17,7 +17,7 @@
1717
<dependency>
1818
<groupId>it.geosolutions.mapstore</groupId>
1919
<artifactId>mapstore-webapp</artifactId>
20-
<version>1.2.1</version>
20+
<version>1.2-SNAPSHOT</version>
2121
<type>war</type>
2222
<scope>runtime</scope>
2323
</dependency>
@@ -409,7 +409,7 @@
409409
<dependency>
410410
<groupId>org.mapfish.print</groupId>
411411
<artifactId>print-lib</artifactId>
412-
<version>geosolutions-2.0</version>
412+
<version>geosolutions-2.0.1</version>
413413
<exclusions>
414414
<exclusion>
415415
<groupId>commons-codec</groupId>

‎project/custom/templates/web/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,22 +21,22 @@
2121
<dependency>
2222
<groupId>it.geosolutions.mapstore</groupId>
2323
<artifactId>mapstore-services</artifactId>
24-
<version>1.2.1</version>
24+
<version>1.2-SNAPSHOT</version>
2525
</dependency>
2626
<!-- ================================================================ -->
2727
<!-- GeoStore modules -->
2828
<!-- ================================================================ -->
2929
<dependency>
3030
<groupId>it.geosolutions.geostore</groupId>
3131
<artifactId>geostore-webapp</artifactId>
32-
<version>1.7.0</version>
32+
<version>1.7.1</version>
3333
<type>war</type>
3434
<scope>runtime</scope>
3535
</dependency>
3636
<dependency>
3737
<groupId>proxy</groupId>
3838
<artifactId>http_proxy</artifactId>
39-
<version>1.1.0</version>
39+
<version>1.1.1</version>
4040
<type>war</type>
4141
<scope>runtime</scope>
4242
</dependency>

‎project/standard/templates/web/pom.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,22 +21,22 @@
2121
<dependency>
2222
<groupId>it.geosolutions.mapstore</groupId>
2323
<artifactId>mapstore-services</artifactId>
24-
<version>1.2.1</version>
24+
<version>1.2-SNAPSHOT</version>
2525
</dependency>
2626
<!-- ================================================================ -->
2727
<!-- GeoStore modules -->
2828
<!-- ================================================================ -->
2929
<dependency>
3030
<groupId>it.geosolutions.geostore</groupId>
3131
<artifactId>geostore-webapp</artifactId>
32-
<version>1.7.0</version>
32+
<version>1.7.1</version>
3333
<type>war</type>
3434
<scope>runtime</scope>
3535
</dependency>
3636
<dependency>
3737
<groupId>proxy</groupId>
3838
<artifactId>http_proxy</artifactId>
39-
<version>1.1.0</version>
39+
<version>1.1.1</version>
4040
<type>war</type>
4141
<scope>runtime</scope>
4242
</dependency>
@@ -536,7 +536,7 @@
536536
<dependency>
537537
<groupId>org.mapfish.print</groupId>
538538
<artifactId>print-lib</artifactId>
539-
<version>geosolutions-2.0</version>
539+
<version>geosolutions-2.0.1</version>
540540
</dependency>
541541
</dependencies>
542542
</profile>

‎release/bin-war/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
<dependency>
1919
<groupId>it.geosolutions.mapstore</groupId>
2020
<artifactId>mapstore-product</artifactId>
21-
<version>1.2.1</version>
21+
<version>1.2-SNAPSHOT</version>
2222
<type>war</type>
2323
<scope>runtime</scope>
2424
</dependency>

0 commit comments

Comments
 (0)