Patch 2025.2.12

PostgreSQL JDBC Driver CVEs

A vulnerability CVE-2026-54291 has been disclosed, affeting the PostgreSQL JDBC driver.

While the PostgreSQL driver is bundled with INFOMOTION Data Management Center, the vulnerability only affects very specific combinations of parameters and makes DMC installations using PostgreSQL potentially vulnerable to man-in-the-middle attackes on the connection to the backend database.

Additionally, two separate vulnerabilities CVE-2026-59083 and CVE-2026-59084 have been disclosed affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options.

• CVE-2026-59084 is based on insufficient technical documentation of the EncryptInterceptor. However, this interceptor is not used inside DMC in the default configuration or any customer configuration known to us. Therefore, to the best of our knowledge, we do not expect DMC to be affted by this vulnerability.
• CVE-2026-59083 is based on incorrect decoding of input data in Tomcat's RewriteValve component. As far as we can ascertain, this component is inactive in both containerized and standalone deployments of DMC and it is therefore not affected by this issue.

Nonetheless, we are now releasing an updated version 2025.2.12 of Data Management Center that includes a patched version of the PostgreSQL JDBC driver and of Apache Tomcat.

Please note that the patch only secures Tomcat in containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes

• Resolve PostgreSQL type-inference error on DATE/NUMBER PK update

(since 2025.2.11)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:cf3645b093589aa6cecffef8d3ef2d0c8bd0875afd2a83c5398e90f527f7944d

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.12/dmc.war (sha256: bab76491204253b5a1364f556ab0b22a535601fa2ad357c4fbec329884504a7e)