Chapter 7. Known Issues

Apache Solr is a popular open source search platform that uses the Apache Lucene search engine. If your application uses a combination of Apache Solr with Apache Lucene (for example, when using the Camel Solr component), it could be affected by this security vulnerability. Please consult the linked security advisory for more details of this vulnerability and the mitigation steps to take.

Applications that that use the FasterXML jackson-databind library to instantiate Java objects by deserializing JSON content are potentially vulnerable to a remote code execution attack. The vulnerability is not automatic, however, and it can be avoided if you take the appropriate mitigation steps.

At a minimum, the following prerequisites must all be satisfied before an attack becomes possible:

If you do need to use the jackson-databind library in your application, the most important measure you can take to mitigate the risk is this: avoid polymorphic type handling in Jackson JSON and on no account should you call the ObjectMapper.enableDefaultTyping() method.

The Camel Dozer, camel-dozer, component and the Camel Shiro, camel-shiro, component depend on a version of the commons-beanutils library that has a CVE security vulnerability. Your application could potentially be affected by this security vulnerability, if you deploy the Camel Dozer or Camel Shiro component in one of the following containers:

For the Spring Boot 1 and Spring Boot 2 container types, you can work around this security vulnerability by customizing the dependencies in your project’s Maven POM file.

For the JBoss EAP container type, no workaround is available at this time and we therefore recommend that you do not use the Camel Dozer or Camel Shiro components with Fuse on EAP. After Fuse 7.6.0 is released, a patch will be made available to fix the common-beanutils dependency in Fuse on EAP. Contact Red Hat Support for details of the patch.

To work around the dependency issue on Spring Boot 1 and Spring Boot 2, modify the Maven POM file for the application, as follows. For example, given a dependency on the camel-dozer-starter artifact, like this:

        <dependency>
            <groupId>org.apache.camel</groupId>
            <artifactId>camel-dozer-starter</artifactId>
        </dependency>

Modify the preceding dependency, replacing it with the following lines:

        <dependency>
            <groupId>org.apache.camel</groupId>
            <artifactId>camel-dozer-starter</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>commons-beanutils</groupId>
                    <artifactId>commons-beanutils</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.9.4.redhat-00002</version>
        </dependency>

In Fuse 7.6, the Postgres version check is performed during a fresh install, although it is only required during an upgrade. This causes spurious error messages in the log, like the following, which can be safely ignored:

{"level":"error","ts":1583164580.847065,"logger":"configuration","msg":"Unable to determine current version of PostgreSQL running in syndesis-db pod","error":"dial tcp: lookup syndesis-db on 10.0.145.81:53: no such host"

When installing Fuse Online using the operator, the following error occurs multiple times, but it can be ignored as it has no significant effect on the installation:

{"level":"error","ts":1558617960.2453232,"logger":"controller","msg":"Error reconciling","action":"*action.startupAction","phase":"Starting","error":"Operation cannot be fulfilled on syndesises.syndesis.io \"app\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/syndesisio/syndesis/install/operator/vendor/github.com/go-logr/zapr.(*zapLogger).Error\n\t/go/src/github.com/syndesisio/syndesis/install/operator/vendor/github.com/go-logr/zapr/zapr.go:128\ngithub.com/syndesisio/syndesis/install/operator/pkg/controller/syndesis.(*ReconcileSyndesis).Reconcile\n\t/go/src/github.com/syndesisio/syndesis/install/operator/pkg/controller/syndesis/syndesis_controller.go:120\ngithub.com/syndesisio/syndesis/install/operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/src/github.com/syndesisio/syndesis/install/operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:215\ngithub.com/syndesisio/syndesis/install/operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func1\n\t/go/src/github.com/syndesisio/syndesis/install/operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:158\ngithub.com/syndesisio/syndesis/install/operator/vendor/k8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/go/src/github.com/syndesisio/syndesis/install/operator/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:133\ngithub.com/syndesisio/syndesis/install/operator/vendor/k8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/go/src/github.com/syndesisio/syndesis/install/operator/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:134\ngithub.com/syndesisio/syndesis/install/operator/vendor/k8s.io/apimachinery/pkg/util/wait.Until\n\t/go/src/github.com/syndesisio/syndesis/install/operator/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:88"}

In Fuse 7.5.0, some of the Spring Boot 2 quickstarts (generated either from Maven archetypes or quickstart templates) fail to build and deploy to OpenShift. The following Spring Boot 2 Maven archetypes are affected:

And the following Spring Boot 2 templates:

To work around this issue, after generating a Maven project for one of these quickstarts, edit the project’s Maven pom.xml file to add the following dependency:

<dependency>
  <groupId>org.assertj</groupId>
  <artifactId>assertj-core</artifactId>
  <version>2.4.1</version>
  <scope>test</scope>
</dependency>

In Fuse 7.6, the Spring Boot 2 bill of materials (BOM) file references an unproductised version of Fuse Console (Hawtio). To work around this problem, in the Maven POM file for your Spring Boot 2 project, add the following lines to the dependency management section of the POM:

<dependencyManagement>
  <dependency>
    <groupId>io.hawt</groupId>
    <artifactId>hawtio-springboot</artifactId>
    <version>2.0.0.fuse-sb2-760022-redhat-00001</version>
  </dependency>
</dependencyManagement>

In the Fuse 7.0 GA release, in the Apache Karaf container the start level of hot deployed bundles is 80 by default. This can cause problems for the hot deployed bundles, because there are many system bundles and features that have the same start level. To work around this problem and ensure that hot deployed bundles start reliably, edit the etc/org.apache.felix.fileinstall-deploy.cfg file and change the felix.fileinstall.start.level setting as follows:

felix.fileinstall.start.level = 90

The framework-security OSGi feature must be installed using the --no-auto-refresh option, otherwise this feature will shut down the Apache Karaf container. For example:

feature:install -v --no-auto-refresh framework-security