Chapter 7. Known Issues

Apache Solr is a popular open source search platform that uses the Apache Lucene search engine. If your application uses a combination of Apache Solr with Apache Lucene (for example, when using the Camel Solr component), it could be affected by this security vulnerability. Please consult the linked security advisory for more details of this vulnerability and the mitigation steps to take.

Applications that that use the FasterXML jackson-databind library to instantiate Java objects by deserializing JSON content are potentially vulnerable to a remote code execution attack. The vulnerability is not automatic, however, and it can be avoided if you take the appropriate mitigation steps.

At a minimum, the following prerequisites must all be satisfied before an attack becomes possible:

It is the existence of a large number of gadget classes which explains why there are many individual CVEs related to the jackson-databind vulnerability. There are different CVEs related to different kinds of gadget class.

If you do need to use the jackson-databind library in your application, the most important measure you can take to mitigate the risk is this: avoid polymorphic type handling in Jackson JSON and on no account should you call the ObjectMapper.enableDefaultTyping() method.

When logout is invoked, it does not reliably clear all of the cookies for Ignite. Each environment with a different authentication provider (for example, RH-SSO or GitHub) presents different symptoms. Basic Authentication seems to be the most reliable, but problems have been reported in Firefox.

To avoid problems with stale cookies after logout, it is recommended that you clear the cache of Ignite cookies on your browser after logging out.

When deploying a Fuse on OpenShift application to OpenShift Container Platform 3.7 using the Fabric8 Maven plugin, you cannot redeploy the application using the command mvn fabric8:deploy. That is, the first time you deploy using mvn fabric8:deploy, the operation succeeds, but the second (and subsequent attempts) fail silently. The workaround is to undeploy before you redeploy, as follows:

mvn fabric8:undeploy
mvn fabric8:deploy

In the Fuse 7.0 GA release, the spring-boot-cxf-jaxrs and spring-boot-cxf-jaxws quickstarts for Fuse on OpenShift raise a ClassNotFoundException exception when building the project.

You can fix this error in the spring-boot-cxf-jaxws quickstart by editing the project’s pom.xml file to add the correct version of the logback-core dependency, as follows:

      <dependency>
        <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-spring-boot-starter-jaxws</artifactId>
        <exclusions>
          <exclusion>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-tomcat</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-core</artifactId>
        <version>1.1.11</version>
      </dependency>

You can fix this error in the spring-boot-cxf-jaxrs quickstart by editing the project’s pom.xml file to add the correct version of the logback-core dependency and the guava dependency version, as follows:

      <dependency>
        <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-spring-boot-starter-jaxrs</artifactId>
        <exclusions>
          <exclusion>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-tomcat</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-core</artifactId>
        <version>1.1.11</version>
      </dependency>
      ...
      <dependency>
        <groupId>io.swagger</groupId>
        <artifactId>swagger-jaxrs</artifactId>
        <exclusions>
          <exclusion>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
          </exclusion>
         </exclusions>
      </dependency>

      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>20.0</version>
      </dependency>

In the Fuse 7.0 GA release, the following features cannot be installed in the Apache Karaf container:

camel-elasticsearch-rest
camel-hystrix
camel-jcifs
camel-olingo2
camel-olingo4
camel-rx
cxf-http-async
camel-spring-redis
connector

These features will be made available in a patch release for Fuse 7.0.

In the Fuse 7.0 GA release, in the Apache Karaf container the start level of hot deployed bundles is 80 by default. This can cause problems for the hot deployed bundles, because there are many system bundles and features that have the same start level. To work around this problem and ensure that hot deployed bundles start reliably, edit the etc/org.apache.felix.fileinstall-deploy.cfg file and change the felix.fileinstall.start.level setting as follows:

felix.fileinstall.start.level = 90

In the Fuse 7.0 GA release, the Apache Karaf container fails to start on the HP-UX platform, reporting the error karaf: JVM must be greater than 1.8. To work around this error, edit the bin/inc script in your Apache Karaf installation. Replace the following line:

VERSION=$("${JAVA}" -version 2>&1 | grep -i version | sed 's/.*version ".*\.\(.*\)\..*"/\1/; 1q')

With this line:

VERSION=$("${JAVA}" -version 2>&1 | grep -i version | sed 's/.*version "[^\._]*\.\([^\._]*\)\..*"/\1/; 1q')

The framework-security OSGi feature must be installed using the --no-auto-refresh option, otherwise this feature will shut down the Apache Karaf container. For example:

feature:install -v --no-auto-refresh framework-security

When using the Apache Karaf container with IBM Java version 1.7.0, the following quickstarts can fail:

camel-avro, camel-hbase, camel-hdfs2 are not supported on Solaris / AIX. The camel-hdfs2 feature can only run if you have libsnappyjava.dylib in java.library.path. You must manually set up libsnappyjava.dylib in Fuse before installing these features.

JBossFuse:karaf@root> features:info camel-hdfs2
		Description of camel-hdfs2 2.15.0.redhat-620133 feature

When a Fuse container is deployed on RHEL OpenStack Platform, it can take a long time (several minutes) for the container to start up. A workaround is to add the following option to the JVM that starts the container (for example, by setting the JAVA_OPTS environment variable):

-Djava.security.egd=file:/dev/./urandom

The extra dot in the pathname, as in /./, is required.