Chapter 7. Known Issues

The following subsections describe the known issues in version 7.9.

7.1. CVE Security Vulnerabilities

As a middleware integration platform, Fuse can potentially be integrated with a large number of third-party components. It is not always possible to exclude the possibility that some third-party dependencies of Fuse could have security vulnerabilities. This section documents known common vulnerabilities and exposures (CVEs) related to security that affect third-party dependencies of Fuse 7.9.

CVE-2020-13936 CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Fuse 7.9 has modified its dependencies to ensure that it uses only the Velocity version (that is, version 2.3) that has been fixed to protect against this security vulnerability. If your application code has any explicit dependencies on the Apache Velocity component, we recommend that you upgrade these dependencies to use the fixed version.

ENTESB-8113 CVE-2018-10237 guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service [fuse-7.0.0]

Google Guava versions 11.0 through 24.1 are vulnerable to unbounded memory allocation in the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization). An attacker could exploit applications that use Guava and deserialize untrusted data to cause a denial of service — for more details, see CVE-2018-10237.

To avoid this security vulnerability, we recommend that you:

  • Never deserialize an AtomicDoubleArray instance or a CompoundOrdering instance from an unknown source.
  • Avoid using Guava versions 24 and earlier (although in some cases it is not possible to avoid the earlier versions).

To make it easier to avoid the earlier (vulnerable) versions of Guava, Fuse 7.7 has configured its Maven Bill of Materials (BOM) files for all containers to select Guava 27 by default. This means that if you incorporate a Fuse BOM into your Maven project (by adding a dependency on the BOM to the dependencyManagement section of your POM file) and then specify a dependency on the Guava artifact without specifying an explicit version, the Guava version will default to the version specified in the BOM, which is version 27 for the Fuse 7.7 BOMs.

But there is at least one common use case involving the Apache Karaf (OSGi) container, where it is not possible to avoid using a vulnerable version of Guava: if your OSGi application uses Guava and Swagger together, you are obliged to use Guava 20, because that is the version required by Swagger. Here we explain why this is the case and how to configure your POM file to revert the earlier (vulnerable) Guava 20 library. First, you need to understand the concept of a double OSGi chain.

Double OSGi chain

Bundles in the OSGi runtime are wired together using package constraints (package name + optional version/range) — imports and exports. Each bundle can have multiple imports and usually those imports wire a given bundle with multiple bundles. For example:

BundleA
+-- BundleB
|   +-- BundleCa
+-- BundleCb

Where BundleA depends on BundleB and BundleCb, while BundleB depends on BundleCa. BundleCa and BundleCb should be the same bundle, if the export the same packages, but due to version (range) constraints, BundleB uses (wires to) a different revision/version of BundleC than BundleA.

Rewriting the preceding diagram to reflect what happens when you include dependencies on both Guava and Swagger in an application:

org.jboss.qe.cxf.rs.swagger-deployment
+-- Guava 27
+-- Swagger 1.5
    +-- reflections 0.9.11
        +-- Guava 20

If you try to deploy this bundle configuration, you get the error, org.osgi.framework.BundleException: Uses constraint violation.

Reverting to Guava 20

If your project uses both Guava and Swagger libraries (directly or indirectly), you should configure the maven-bundle-plugin to use an explicit version range (or no range at all) for the Guava bundle import, as follows:

<Import-Package>
    com.google.common.base;version="[20.0,21.0)",
    com.google.common.collect;version="[20.0,21.0)",
    com.google.common.io;version="[20.0,21.0)"
</Import-Package>

This configuration forces your OSGi application to revert to the (vulnerable) Guava 20 library. It is therefore particularly important to avoid deserializing AtomicDoubleArray instances in this case.

CVE-2017-12629 Solr/Lucene -security bypass to access sensitive data - CVE-2017-12629

Apache Solr is a popular open source search platform that uses the Apache Lucene search engine. If your application uses a combination of Apache Solr with Apache Lucene (for example, when using the Camel Solr component), it could be affected by this security vulnerability. Please consult the linked security advisory for more details of this vulnerability and the mitigation steps to take.

Note

The Fuse runtime does not use Apache Solr or Apache Lucene directly. The security risk only arises, if you are using Apache Solr and Apache Lucene together in the context of an integration application (for example, when using the Camel Solr component).

7.2. Fuse Online

The Fuse Online distribution has the following known issues:

ENTESB-17137 Cannot access Fuse Online on disconnected environment

In Fuse 7.9, after installing Fuse Online on a disconnected OpenShift Container Platform (OCP) cluster, you cannot access the UI for Fuse Online. When you try to access the UI, you get the following error:

504 Gateway Time-out
The server didn't respond in time.

To work around this issue, you need to scale the Fuse Online Operator down to zero, and then set three environment variables in the Syndesis OAuth Proxy deployment configuration. You can do this at the command line, by entering the following commands:

oc scale deployment fuse-online-operator --replicas 0
sleep 10
oc set env deploymentconfig/syndesis-oauthproxy HTTP_PROXY=$(oc get proxy cluster -o jsonpath='{.status.httpProxy}')
oc set env deploymentconfig/syndesis-oauthproxy HTTPS_PROXY=$(oc get proxy cluster -o jsonpath='{.status.httpsProxy}')
oc set env deploymentconfig/syndesis-oauthproxy NO_PROXY=$(oc get proxy cluster -o jsonpath='{.status.noProxy}')

Note that the Fuse Online Operator must remain scaled at zero. If you scale the Operator back to one, it will overwrite the environment variables, resetting them to the (incorrect) default values.

ENTESB-16987 [Hawtio] Broken layout for drop-down menu in OSGi → Features
Since Fuse 7.8, when using the Fuse Console on Apache Karaf, on the OSGi | Features tab, the Filter by repository dropdown menu has a bad layout.
ENTESB-16989 DataMapper backslash delimiter in split transformation works only when the message has double backslashes
Since Fuse 7.9, when using the DataMapper one-to-many split transformation, if you choose the backslash character, \, as the delimiter to define the split points, the split transformation will succeed only if the backslash character is escaped by another backslash. In other words, the splits are made on each occurrence of a double backslash, \\. The JSON standard requires backslash literals to be escaped by another backslash, so this behavior is consistent with the JSON standard.
ENTESB-16990 DataMapper multi spaces delimiter in split transformation behaves as "double spaces" delimiter
Since Fuse 7.9, when using the DataMapper one-to-many split transformation, if you choose a multi-space delimiter consisting of more than two spaces to define the split points, the split content will contain additional space(s). For example, when using a multi-space delimiter consisting of n spaces, the resulting split fields will be preceeded by n-2 spaces. In other words, the split transformation behaves as if it was splitting on a double space.
ENTESB-15063 Unable to override maven repositories

Since Fuse 7.8, if you are running Fuse Online in an offline (disconnected from the internet) environment and you have configured the Fuse Online custom resource (CR) to use a custom Maven repository on your local network, for example:

...
      server:
        features:
          maven:
            append: false
            repositories:
              customRepo1: http://192.0.2.0:8080
...

Then there are particular circumstances where other Maven repositories are consulted, in addition to the specified customRepo1, in spite of the fact that the append: false flag is specified in the CR. For example, this can happen if Fuse Online is configured to use extensions that download Maven dependencies while they are building. Typically, this issue causes longer build times, because the incorrect Maven repositories are consulted before the specified custom Maven repository, which wastes time during the build process.

ENTESB-15348 Syndesis-jaeger uses unproductized image on OCP 3.11

Since Fuse 7.8, if you are attempting to install Fuse Online on OCP 3.11 with the Jaeger add-on enabled (enhanced activity tracking), it is possible you might encounter the following error:

Unknown desc = toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit

This happens because the productised Jaeger container references Dockerhub images, which are out of Red Hat’s control. To work around this issue, you can either wait until rate limit window times out, or disable the Jaeger add-on.

ENTESB-14518 Jaeger operator installed by Syndesis 1.11 affects other namespaces
Since Fuse 7.8, when you install Fuse 7.8 Online (Syndesis 1.11) on an OpenShift cluster, the Jaeger Operator (which gets installed along with Fuse Online) is configured to manage All namespaces by default. A side effect of this behavior is that, in the case where you already have Fuse 7.7 Online (Syndesis 1.10) installed on a cluster and then you install Fuse 7.8 Online in a different namespace, the Jaeger Operator installed with Fuse 7.8 Online tries to manage the (older) Jaeger instance installed on the Fuse 7.7 Online namespace. The result is that a new syndesis-jaeger pod — in addition to the existing syndesis-jaeger pod — appears in the Fuse 7.7 Online namespace and the new syndesis-jaeger pod enters the CrashLoopBackOff state. The original Fuse 7.7 Online instance is not affected and the crashed syndesis-jaeger pod can be safely ignored.
ENTESB-13966 Discovery of deployed integration API seems disabled but not really
Starting in Fuse 7.7, after creating a new integration containing an API, the integration detail page wrongly implies that 3scale discovery is disabled for this integration. Additionally, the integration detail page does not show the API URL. By clicking this button three times (click Enable, then click Disable, then click Enable), you can resynchronize the page so that 3scale discovery is enabled and the API URL is displayed.

7.3. Fuse on OpenShift

This section lists issues that affect the deployment of Fuse applications on OpenShift. For details of issues affecting specific containers, see also the sections for Spring Boot, Fuse on Apache Karaf, and Fuse on JBoss EAP. The Fuse on OpenShift distribution has the following known issues:

ENTESB-17144 Fuse Camel project generated by Apicurito Generator not exposes management port

In Fuse 7.9, a Fuse Camel project generated by API Designer (Apicurito Generator) does not expose a management port, because the file, src/main/resources/application.yml is configured incorrectly. The generated src/main/resources/application.yml file has the following configuration:

management:
  port: 8081
endpoints:
  enabled: false
  health:
    enabled: true

This configuration must be changed to:

management:
  server:
    port: 8081

  endpoints:
    enabled-by-default: false

  endpoint:
    health:
      enabled: true

Moreover, the pom.xml file in the generated project uses the fabric8-maven-plugin, which is deprecated. It is preferable to use the new openshift-maven-plugin in a Maven project.

ENTESB-17125 Quickstart Spring-Boot Soap2Rest integration tests fail because of invalid algorithm parameter
In Fuse 7.9, the Spring Boot Soap2Rest integration tests are failing, but this does not affect the functionality.
ENTESB-17091 Missing metering labels on spring-boot-camel-rhosak quickstart
In Fuse 7.9, Fuse running on Spring Boot 2 does not support metering labels.
ENTESB-15994 API Designer upgrade from 7.8 to 7.9 requires delete and reinstall
In Fuse 7.9, The normal operator upgrade process does not work when upgrading from API Designer 7.8 to API Designer 7.9. To upgrade the API Designer from Fuse 7.8 to Fuse 7.9, you must delete the 7.8 API Designer operator and then install the 7.9 API Designer operator.
ENTESB-16814 Monitoring resources are linked wrongly from the documentation
Since Fuse 7.8, the locations of the monitoring resources referenced in section 2.5.2. Setting up Prometheus of the Fuse on OpenShift Guide are incorrect and return a 404 exception. This documented procedure will be fixed in a post-GA documentation update.
ENTESB-16287 Unable to start Karaf

In Fuse 7.9, when building a Karaf application to run on OpenShift, you must edit the pom.xml, adding a line to the Import-Package section of the POM file to specify the explicit version range for javax.annotation;version="[1.3,2.0)" for the javax.annotation package.

For example, if the Import-Package section in your pom.xml file looks like this:

<Import-Package>
   javax.ws.rs;version="[2, 3)",
   javax.ws.rs.core;version="[2, 3)",
   javax.ws.rs.ext;version="[2, 3)",
   javax.xml.bind;version="[2,3)",
   javax.xml.bind.annotation;version="[2,3)",
   org.osgi.service.blueprint,
   org.apache.cxf.transport.http,
   *
</Import-Package>

You would add a line with javax.annotation;version="[1.3,2.0)", so that the section looks like:

<Import-Package>
   javax.annotation;version="[1.3,2.0)",
   javax.ws.rs;version="[2, 3)",
   javax.ws.rs.core;version="[2, 3)",
   javax.ws.rs.ext;version="[2, 3)",
   javax.xml.bind;version="[2,3)",
   javax.xml.bind.annotation;version="[2,3)",
   org.osgi.service.blueprint,
   org.apache.cxf.transport.http,
   *
</Import-Package>

The reason this is needed is because some common third-party dependencies can pull in the wrong version of the javax.annotations library into the Karaf container.

7.4. Fuse on Apache Karaf

Fuse on Apache Karaf has the following known issues:

ENTESB-16417 Credential store is using PBEWithSHA1AndDESede by default
The security API in OpenJDK 8u292 and in OracleJDK 1.8.0_291 returns an incomplete list of security providers, which causes the credential store in Apache Karaf to fail (because the required security provider appears to be unavailable). The underlying issue that causes this problem is https://bugs.openjdk.java.net/browse/JDK-8249906. We recommend that you use the earlier OpenJDK version, OpenJDK 8u282, or the later OpenJDK version, OpenJDK 8u302, which do not have this bug.
ENTESB-16526 fuse-karaf on Windows cannot restart during patch:install

While running patch:install in the Apache Karaf container on the Windows platform, under certain circumstances you might encounter the following error when the patch:install command attempts an automatic restart of the container:

Red Hat Fuse starting up. Press Enter to open the shell now...
100% [========================================================================]
Karaf started in 18s. Bundle stats: 235 active, 235 total
'.tmpdir' is not recognized as an internal or external command,
operable program or batch file.
There is a Root instance already running with name ~14 and pid ~13. If you know what you are doing and want to force the run anyway, SET CHECK_ROOT_INSTANCE_RUNNING=false and re run the command.

If you encounter this error, simply restart the Karaf container manually.

ENTESB-8140 Start level of hot deploy bundles is 80 by default

Starting in the Fuse 7.0 GA release, in the Apache Karaf container the start level of hot deployed bundles is 80 by default. This can cause problems for the hot deployed bundles, because there are many system bundles and features that have the same start level. To work around this problem and ensure that hot deployed bundles start reliably, edit the etc/org.apache.felix.fileinstall-deploy.cfg file and change the felix.fileinstall.start.level setting as follows:

felix.fileinstall.start.level = 90
ENTESB-7664 Installing framework-security feature kills karaf

The framework-security OSGi feature must be installed using the --no-auto-refresh option, otherwise this feature will shut down the Apache Karaf container. For example:

feature:install -v --no-auto-refresh framework-security

7.5. Fuse on JBoss EAP

Fuse on JBoss EAP has the following known issues:

JBEAP-21929 (7.4.z) org.infinispan.client.hotrod module is missing a dependency on org.infinispan.protostream

In Fuse 7.9, the Camel Infinispan (camel-infinispan) component does not work for Fuse on JBoss EAP, because JBoss EAP 7.4.0 is missing a dependency on org.infinispan.protostream (see also ENTESB-16186). If you get the following error when using the Camel Infinispan component in Fuse on JBoss EAP 7.4.0:

java.lang.NoClassDefFoundError: org/infinispan/protostream/SerializationContextInitializer
    Caused by: java.lang.ClassNotFoundException: org.infinispan.protostream.SerializationContextInitializer from [Module \"org.infinispan.client.hotrod\" version 11.0.9.Final-redhat-00001 from local module loader

You can work around this problem by modifying $EAP_HOME/modules/system/layers/base/org/infinispan/client/hotrod/main/module.xml, adding the org.infinispan.protostream module as follows:

<module name="org.infinispan.client.hotrod" xmlns="urn:jboss:module:1.x">
    <properties>
        <property name="jboss.api" value="private"/>
    </properties>

    <resources>
        <resource-root path="infinispan-client-hotrod-x.x.x.Final-redhat-00001.jar"/>
    </resources>

    <dependencies>
        <module name="javax.api"/>
        <module name="javax.transaction.api"/>
        <module name="com.google.protobuf" optional="true"/>
        <module name="io.netty"/>
        <module name="org.infinispan.commons"/>
        <module name="org.jboss.logging"/>
        <module name="org.infinispan.protostream" optional="true"/>  <!-- add this line -->
    </dependencies>
</module>

As this problem arises in the underlying JBoss EAP container, the problem could be solved by upgrading to a fixed (and supported) version of JBoss EAP as soon as a fix becomes available.

ENTESB-13168 Camel deployment on EAP domain mode is not working on Windows
Starting in Fuse 7.6.0, for Fuse on JBoss EAP, the Camel subsystem cannot be deployed on JBoss EAP in domain mode on Windows OS.

7.6. Fuse Tooling

Fuse Tooling has the following known issue:

FUSETOOLS-3460 Fuse Tooling temporarily uses deprecated templates
After CodeReady Studio 12.21 is released, Fuse Tooling will migrate from using the fabric8-maven-plugin to the openshift-maven-plugin.
_FUSETOOLS-3384_Fuse Tooling temporarily uses Java 8
While Fuse Tooling currently works with Java 11, full support for the templates that use Java 11 will be provided with Fuse Tooling in the CodeReady Studio 12.21 release.

7.7. Apache Camel

Apache Camel has the following known issues:

ENTESB-15343 XSLT component not working properly with IBM1.8 JDK
In Fuse 7.8, the Camel XSLT component does not work properly with the IBM 1.8 JDK. The problem occurs because the underlying Apache Xerces implementation of XSLT does not support the javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING property (see XERCESJ-1654).
ENTESB-11060 [camel-linkedin] V1 API is no longer supported
Since Fuse 7.4.0, the Camel LinkedIn component is no longer able to communicate with the LinkedIn server, because it is implemented using the LinkedIn Version 1.0 API, which is no longer supported by LinkedIn. The Camel LinkedIn component will be updated to use the Version 2 API in a future release of Fuse.
ENTESB-7469 Camel Docker component cannot use Unix socket connections on EAP
Since Fuse 7.0, the camel-docker component can connect to Docker only through its REST API, not through UNIX sockets.
ENTESB-5231 PHP script language does not work
The PHP scripting language is not supported in Camel applications on the Apache Karaf container, because there is no OSGi bundle available for PHP.
ENTESB-5232 Python language does not work
The Python scripting language is not supported in Camel applications on the Apache Karaf container, because there is no OSGi bundle available for Python.
ENTESB-2443 Google Mail API - Sending of messages and drafts is not synchronous
When you send a message or draft, the response contains a Message object with an ID. It may not be possible to immediately get this message via another call to the API. You may have to wait and retry the call.
ENTESB-2332 Google Drive API JSON response for changes returns bad count of items for the first page
Google Drive API JSON response for changes returns bad count of items for the first page. Setting maxResults for a list operation may not return all the results in the first page. You may have to go through several pages to get the complete list (that is by setting pageToken on new requests).