Chapter 7. Known Issues

Apache Solr is a popular open source search platform that uses the Apache Lucene search engine. If your application uses a combination of Apache Solr with Apache Lucene (for example, when using the Camel Solr component), it could be affected by this security vulnerability. Please consult the linked security advisory for more details of this vulnerability and the mitigation steps to take.

Applications that that use the FasterXML jackson-databind library to instantiate Java objects by deserializing JSON content are potentially vulnerable to a remote code execution attack. The vulnerability is not automatic, however, and it can be avoided if you take the appropriate mitigation steps.

At a minimum, the following prerequisites must all be satisfied before an attack becomes possible:

It is the existence of a large number of gadget classes which explains why there are many individual CVEs related to the jackson-databind vulnerability. There are different CVEs related to different kinds of gadget class.

If you do need to use the jackson-databind library in your application, the most important measure you can take to mitigate the risk is this: avoid polymorphic type handling in Jackson JSON and on no account should you call the ObjectMapper.enableDefaultTyping() method.

With using some older CDK versions, you are likely to encounter the following error when you try to start minishift:

minishift start
-- Starting profile 'minishift'
-- Check if deprecated options are used ... OK
-- Checking if https://mirror.openshift.com is reachable ... OK
-- Checking if requested OpenShift version 'v3.11.16' is valid ... FAIL

To avoid this issue, use CDK 3.8 (or later) with Fuse 7.3.

Karaf-based applications deployed to Fuse on OpenShift are affected by this issue, if they use message attachments (implying a dependency on the javax.activation package). A typical symptom of this issue would be an error message like the following:

Caused by: java.lang.LinkageError: loader constraint violation: when resolving overridden method "org.apache.cxf.jaxrs.provider.JAXBAttachmentMarshaller.addMtomAttachment(Ljavax/activation/DataHandler;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;" the class loader (instance of org/apache/felix/framework/BundleWiringImpl$BundleClassLoader) of the current class, org/apache/cxf/jaxrs/provider/JAXBAttachmentMarshaller, and its superclass loader (instance of <bootloader>), have different Class objects for the type javax/activation/DataHandler used in the signature

If you get an error message like this from your Karaf-based application deployed on OpenShift, you can fix the issue by modifying the application’s Maven project as follows. In your Maven project, create a new jre.properties file at the following location:

src/main/resources/assembly/etc/jre.properties

And add the content from this sample jre.properties file.

When the application is redeployed, this custom jre.properties file overrides the default JRE properties of the Karaf micro-container. In particular, the custom jre.properties file adds the following line to the jre-1.8 property, which is missing from the default:

javax.activation;version="1.1", \

In the Fuse 7.3 GA release, the following workaround is required to use Apache CXF with the Spring Boot standalone container on the IBM AIX 7.2 platfform. When you run a Spring Boot application, set the Java system property, java.version=1.8.0_131. For example, to run a Spring Boot application from a Maven project, enter:

mvn spring-boot:run -Djava.version=1.8.0_131

In the Fuse 7.3 GA release, the following workaround is required to use Apache CXF with the Apache Karaf container on the IBM AIX 7.2 platfform. Edit the $KARAF_HOME/etc/system.properties file and add the following line:

java.version=1.8.0_131

In the Fuse 7.0 GA release, in the Apache Karaf container the start level of hot deployed bundles is 80 by default. This can cause problems for the hot deployed bundles, because there are many system bundles and features that have the same start level. To work around this problem and ensure that hot deployed bundles start reliably, edit the etc/org.apache.felix.fileinstall-deploy.cfg file and change the felix.fileinstall.start.level setting as follows:

felix.fileinstall.start.level = 90

The framework-security OSGi feature must be installed using the --no-auto-refresh option, otherwise this feature will shut down the Apache Karaf container. For example:

feature:install -v --no-auto-refresh framework-security