You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As per subject of this issue, the current Authzforce GE docker image is vulnerable (for eg. see CVE-2022-29885) due to its dependence on the base tomcat:9-jre11-slim docker image which hasn't been updated in three years and is currently unmaintained.
Unfortunately, simply building the image from another up-to-date official image doesn't work. For example, here's an log excerpt of Authzforce failing when running an image built from tomcat:9-jdk11:
2022-06-09 09:51:36,866|ERROR|main|org.springframework.web.context.ContextLoader:313|Context initialization failed|
org.springframework.beans.factory.BeanDefinitionStoreException: Unexpected exception parsing XML document from ServletContext resource [/WEB-INF/beans.xml]; nested exception is org.springframework.beans.FatalBeanException: Unresolvable class definition for NamespaceHandler class [org.apache.cxf.bus.spring.NamespaceHandler] for namespace [http://cxf.apache.org/core]; nested exception is java.lang.NoClassDefFoundError: javax/xml/ws/WebServiceFeature
I've tested several different base images, both JRE and OpenJDK based, with no success.
This GE is currently deployed on VMs hosted on FIWARE nodes and should be maintained on an updated base image for security reasons.
The text was updated successfully, but these errors were encountered:
As per subject of this issue, the current Authzforce GE docker image is vulnerable (for eg. see CVE-2022-29885) due to its dependence on the base tomcat:9-jre11-slim docker image which hasn't been updated in three years and is currently unmaintained.
Unfortunately, simply building the image from another up-to-date official image doesn't work. For example, here's an log excerpt of Authzforce failing when running an image built from tomcat:9-jdk11:
I've tested several different base images, both JRE and OpenJDK based, with no success.
This GE is currently deployed on VMs hosted on FIWARE nodes and should be maintained on an updated base image for security reasons.
The text was updated successfully, but these errors were encountered: