Bugfixes​

• Properly load previously defined triggers on application startup
• Execute scheduled tasks as system user to avoid permissions errors
• Fix behaviour for very-high-precision numbers on MSSQL

(since 2024.2.5)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.6

Two separate vulnerabilities CVE-2025-31650 and CVE-2025-31651 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.5 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Dependecy Upgrades​

• Upgrade to Spring Boot 3.4.5 including embedded Tomcat 10.1.40 to avoid potential issues with CVE-2025-31650 and CVE-2025-31651

(since 2024.2.4)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.5

Bugfixes​

• Upgrade to Spring Boot 3.4.4 including embedded Tomcat 10.1.39 to avoid potential issues with CVE-2025-24813

(since 2024.2.3)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.4

A vulnerability CVE-2025-24813 has been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat it is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options.

While the vulnerability is flagged as potentially having a critical impact, the published information lists very specific preconditions. Based on our understanding, the information disclosure and remote code execution scenarios depend (among others) on the following preconditions being met:

• The Tomcat default servlet must be enabled
• Additionally, it must be configured enable writes

Both of these are not given in the INFOMOTION Data Management Center:

• The Tomcat Default Servlet is not enabled within DMC.
• Also, the servlet is read-only by default unless explicitly configured otherwise, which DMC does not do.

Nonetheless, we will be releasing an updated version 2024.2.4 of Data Management Center shortly that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Allow users to choose .xlsm files for upload

• Use base image containing shell & mkdir for DMC container build

(since 2024.2.2)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.3

Bugfixes​

• Properly report all columns if multiple required columns are missing

(since 2024.2.1)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.2

Bugfixes​

• Avoid error message when uploading files with duplicate (case-insensitive) column name
• Fix error when displaying all QS violations with QS rules containing placeholders
• Container Image only: Update included Java Runtime Environment (JRE) to 17.0.14 fixing CVE-2025-21502

(since 2024.2.0)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.1

Oracle has published a Security Advisories for Java as part of it's Januar 2025 Critical Patch Update Advisory that is relevant for INFOMOTION Data Management center under certain conditions:

• Generally speaking, Java is not part of DMC itself, which is therefore not directly affected.
• However, the pre-built container images we distribute since Release 2024.1 contain a Java Runtime Environment (Java version 17).

CVE-2025-21502 has been classified by Oracle as a low-impact and high-complexity attack on Java versions up to 17.0.13. Unfortunately, there is not enough information available yet to be able to asses if and how INFOMOTION Data Management Center might be affected by the issue in the underlying JRE.

As a precaution we are releasing an updated DMC version 2024.2.1.

In addition to two bugfixes (see release notes), the container images published for this patch update the JRE to version 17.0.14 which, according to the published information, is not affected by either CVE.

If you have further questions, please create a DMC support ticket via eMail.

Bugfixes​

• Proper validation of empty primary keys during file import
• Fix rare frontend error when editing table properties with empty description
• Revert paginator to show row numbers instead of page numbers
• Avoid potential deadlocks when deleting many cached objects at once...
• Avoid various (transient) error messages when deleting many tables at once
• Remove swagger-ui due to CVE-2024-45801
• Apply default column mappings case-insensitive
• Fix an error occurring when sorting by hist_from in specific cases for MSSQL database
• Fix permissions check when editing table/data permissions
• Increase maximum number of decimal digits when using embedded H2 database

Improvements​

• Allow copying table columns
• Ensure usernames are only logged at DEBUG or TRACE level
• Built-in database ("db") authentication disabled by default
• Frontend improvements for long-running operations (delete multiple tables, import deployment set)
• Additional logging for file imports
• Allow at least partial startup & debug output when configuration is missing
• Allow removal of the last filter

(since 2024.1.6)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.0

The Spring project has published a Security Advisory concerning Spring Framework, an open-source library used by INFOMOTION Data Management Center.

Based on our analysis and the available information, the relevant vulnerability CVE-2024-38828 does not affect INFOMOTION Data Management Center.

The vulnerable components of Spring Framework ("Spring MVC controller methods with an @RequestBody byte[] method parameter") are not used by our application.

If you have further questions, please create a DMC support ticket via eMail.

Bugfixes​

• Revert paginator to show row numbers instead of page numbers

• Upgrade Spring Framework out of caution relating to CVE-2024-38819

(since 2024.1.5)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.6

The Spring project has published a Security Advisory concerning Spring Framework, an open-source library used by INFOMOTION Data Management Center.

It describes a new vulnerability, similar to CVE-2024-38816 which we have previously reported on.

Based on our analysis, this new vulnerability CVE-2024-38819 does not affect INFOMOTION Data Management Center, since our application does not use the vulnerable "functional" components of Spring Framework.

If you have further questions, please create a DMC support ticket via eMail.

Bugfixes​

• Avoid potential deadlocks when deleting many cached objects at once...
• Avoid various (transient) error messages when deleting many tables at once
• Fix NG0100 'changed after checked' frontend error in certain conditions

Improvements​

• Frontend improvements for long-running operations (delete multiple tables, import deployment set)

(since 2023.2.7)

Docker-Image: infomotiondmc.azurecr.io/dmc:2023.2.8

Bugfixes​

• Avoid potential deadlocks when deleting many cached objects at once...
• Avoid various (transient) error messages when deleting many tables at once
• Fix NG0100 'changed after checked' frontend error in certain conditions

Improvements​

• Frontend improvements for long-running operations (delete multiple tables, import deployment set)

(since 2024.1.4)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.5

A security advisory has been published for the DOMPurify open-source library used by an optional part (swagger-ui) of the "Spring Docs" framework for making API documentation available in DMC since version 2023.2.

Please note that "Spring Docs" is included in DMC, but disabled by default. Also, the vulnerability only affects the "Swagger" API-Testing frontend included in Spring Docs, which is neither an officially supported feature of DMC nor something users usually interact with.

Based on our understanding, a cross-site-scripting attack would only be possible if all the following conditions are met:

• the DMC_ENABLE_OPENAPI flag is set to true
• an attacker were able to introduce malicious content into the API-Testing frontend (which does not usually accept and store any user inputs)
• a DMC user were to actually visit the unsupported API-Testing frontend

Affected Versions​

• Release 2023.2 before Patch 2023.2.7
• Release 2024.1 before Patch 2024.1.4

Mitigation​

• The issue is already mitigated by the DMC default configuration.
• If DMC_ENABLE_OPENAPI is currently set to true, it is recommended to switch it to false until a patch has been applied.

Patches​

The Swagger API-Testing frontend has been removed, thereby eliminating the issue, in DMC 2023.2.7 and 2024.1.4.

All officially supported DMC functionality is unaffected by this change.

Bugfixes​

• Remove unneccessary swagger-ui dependency due to CVE-2024-45801

• Make default column mappings case-insensitive (like all column mappings)

(since 2023.2.6)

Docker-Image: infomotiondmc.azurecr.io/dmc:2023.2.7

Bugfixes​

• Remove unneccessary swagger-ui dependency due to CVE-2024-45801

(since 2024.1.3)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.4

Bugfixes​

• Make default column mappings during import case-insensitive like all other import mappings

• Fix an error occurring when sorting by hist_from in specific cases for MSSQL database

(since 2024.1.2)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.3

The Spring project has published a Security Advisory concerning Spring Framework, an open-source library used by INFOMOTION Data Management Center.

Based on our analysis, the relevant vulnerability CVE-2024-38816 does not affect INFOMOTION Data Management Center as long as it is deployed according to specification:

1. Our application does not use RouterFunctions, the vulnerable component of Spring Framework.
2. DMC deployments are only supported on Tomcat application server, which by itself mitigates the issue according to the official blog post by the Spring project.
   Official Docker images published by INFOMOTION also use Tomcat as an application server, as does the "standalone deployment" available since DMC version 2024.1.

If you have further questions, please create a DMC support ticket via eMail.

Bugfixes​

• Fix permissions check when editing table/data permissions

• Fix displaying deleted records with very long texts in historical view

• Correct import of tables with names ending in digits

• Update to Spring 5.3.38 because of CVE-2024-38809

(since 2023.2.5)

Docker-Image: infomotiondmc.azurecr.io/dmc:2023.2.6