Chapter 7. Known Issues
The following subsections describe the known issues in version 7.2.
7.1. CVE Security Vulnerabilities
As a middleware integration platform, Fuse can potentially be integrated with a large number of third-party components. It is not always possible to exclude the possibility that some third-party dependencies of Fuse could have security vulnerabilities. This section documents known security vulnerabilities affecting third-party dependencies of Fuse 7.2.
- ENTESB-12489 CVE-2019-9827 - Fuse Console standalone on Amazon Web Services
-
Due to security concerns, you should not deploy a standalone Fuse application to Amazon Web Services (AWS). This restriction applies to all supported standalone environments (Spring Boot 1.x and 2.x, Karaf, and Red Hat JBoss Enterprise Application Platform). If you want to deploy the Fuse Console standalone on AWS, it is highly recommended that you upgrade to Fuse 7.7 or later and disable the Fuse Console’s proxy servlet by setting the
hawtio.disableProxysystem property totrue. - CVE-2017-12629 Solr/Lucene -security bypass to access sensitive data - CVE-2017-12629
Apache Solr is a popular open source search platform that uses the Apache Lucene search engine. If your application uses a combination of Apache Solr with Apache Lucene (for example, when using the Camel Solr component), it could be affected by this security vulnerability. Please consult the linked security advisory for more details of this vulnerability and the mitigation steps to take.
NoteThe Fuse runtime does not use Apache Solr or Apache Lucene directly. The security risk only arises, if you are using Apache Solr and Apache Lucene together in the context of an integration application (for example, when using the Camel Solr component).
- Multiple CVEs Multiple CVEs related to jackson-databind security vulnerability
Applications that that use the FasterXML
jackson-databindlibrary to instantiate Java objects by deserializing JSON content are potentially vulnerable to a remote code execution attack. The vulnerability is not automatic, however, and it can be avoided if you take the appropriate mitigation steps.At a minimum, the following prerequisites must all be satisfied before an attack becomes possible:
You have enabled polymorphic type handling for deserialization of JSON content in
jackson-databind. There are two alternative ways of enabling polymorphic type handling in Jackson JSON:-
Using a combination of the
@JsonTypeInfoand@JsonSubTypesannotations. -
By calling the
ObjectMapper.enableDefaultTyping()method. This option is particularly dangerous, as it effectively enables polymorphic typing globally.
-
Using a combination of the
-
There are one or more gadget classes in your Java classpath, which have not yet been blacklisted by the current version of
jackson-databind. A gadget class is defined as any class that performs a sensitive (potentially exploitable) operation as a side effect of executing a constructor or a setter method (which are the methods that can be called during a deserialization). The gadget blacklist maintained by the Jackson JSON library is the last line of defence against the remote code execution vulnerability.
It is the existence of a large number of gadget classes which explains why there are many individual CVEs related to the
jackson-databindvulnerability. There are different CVEs related to different kinds of gadget class.If you do need to use the
jackson-databindlibrary in your application, the most important measure you can take to mitigate the risk is this: avoid polymorphic type handling in Jackson JSON and on no account should you call theObjectMapper.enableDefaultTyping()method.
7.2. Fuse Online
The Fuse Online distribution has the following known issues:
- 667 'null' when using "ItemAt" transformation from List<>
Number -
When mapping from a
Listto aDoubletype field using theItemAttransformation, an exception gets thrown by the data mapper. - 1558 "Save as draft" and "Publish" buttons
- Both the Save as draft button and the Publish button remain active, even after a user has clicked on one of the buttons and started stepping through the procedure.
- 698 DB Connector: SQL parser doesn’t recognize parameters for LIKE
-
In SQL statements containing the
LIKEkeyword (for example,DELETE FROM TODO WHERE task LIKE ‘:#param’), theLIKEkeyword cannot be used with datamapper parameters, such as:#param.
7.3. Fuse on OpenShift
This section lists issues that affect the deployment of Fuse applications on OpenShift. For details of issues affecting specific containers, see also the sections for Spring Boot, Fuse on Apache Karaf, and Fuse on JBoss EAP. The Fuse on OpenShift distribution has the following known issues:
- ENTESB-9420 karaf-camel-rest-sql: Build creation stuck on "Receiving source from STDIN as archive"
- When attempting to build and deploy Fuse applications on some early micro versions of OpenShift Container Platform (OCP) 3.10, it is possible that the build will hang with this error. If you encounter this problem, we recommend that you upgrade to OCP 3.10.34 (or later), where this problem is fixed.
- ENTESB-9514 CDK (minishift) + quickstart with binary build doesn’t work
- Red Hat Container Development Kit (CDK) 3.5 uses a version of OpenShift that has some incompatibilities with Fuse 7.2 on OpenShift (in particular, build and deployment of Fuse on OpenShift quickstarts does not work). We recommend that you use CDK 3.8 instead.
7.4. Fuse on Spring Boot
Fuse on Spring Boot has the following known issues:
- ENTESB-9208 XA transaction doesn’t work with MSSQL database
- In the Fuse 7.2.0 GA release, when using Narayana as transaction manager, XA transactions do not work with the MSSQL database. This will be fixed in an upcoming release of Fuse.
7.5. Fuse on Apache Karaf
Fuse on Apache Karaf has the following known issues:
- ENTESB-9750 Swagger doesn’t work in karaf-camel-rest-sql
-
In the Fuse 7.2.0 GA release, the
karaf-camel-rest-sqlquickstart throws an error when you try to access the Swagger API definition by appending/api-docto the endpoint URL. This will be fixed in an upcoming release of Fuse. - ENTESB-8140 Start level of hot deploy bundles is 80 by default
In the Fuse 7.0 GA release, in the Apache Karaf container the start level of hot deployed bundles is 80 by default. This can cause problems for the hot deployed bundles, because there are many system bundles and features that have the same start level. To work around this problem and ensure that hot deployed bundles start reliably, edit the
etc/org.apache.felix.fileinstall-deploy.cfgfile and change thefelix.fileinstall.start.levelsetting as follows:felix.fileinstall.start.level = 90
- ENTESB-7664 Installing framework-security feature kills karaf
The
framework-securityOSGi feature must be installed using the--no-auto-refreshoption, otherwise this feature will shut down the Apache Karaf container. For example:feature:install -v --no-auto-refresh framework-security
7.6. Apache Camel
Apache Camel has the following known issues:
- ENTESB-7469 Camel Docker component cannot use Unix socket connections on EAP
-
In Fuse 7.0, the
camel-dockercomponent can connect to Docker only through its REST API, not through UNIX sockets. - ENTESB-5231 PHP script language does not work
- The PHP scripting language is not supported in Camel applications on the Apache Karaf container, because there is no OSGi bundle available for PHP.
- ENTESB-5232 Python language does not work
- The Python scripting language is not supported in Camel applications on the Apache Karaf container, because there is no OSGi bundle available for Python.
- ENTESB-2443 Google Mail API - Sending of messages and drafts is not synchronous
- When you send a message or draft, the response contains a Message object with an ID. It may not be possible to immediately get this message via another call to the API. You may have to wait and retry the call.
- ENTESB-2332 Google Drive API JSON response for changes returns bad count of items for the first page
- Google Drive API JSON reponse for changes returns bad count of items for the first page. Setting maxResults for a list operation may not return all the results in the first page. You may have to go through several pages to get the complete list (that is by setting pageToken on new requests).
