4 Posts getaggt mit "2026.1"

PostgreSQL JDBC Driver CVEs​

A vulnerability CVE-2026-54291 has been disclosed, affeting the PostgreSQL JDBC driver.

While the PostgreSQL driver is bundled with INFOMOTION Data Management Center, the vulnerability only affects very specific combinations of parameters and makes DMC installations using PostgreSQL potentially vulnerable to man-in-the-middle attackes on the connection to the backend database.

Additionally, two separate vulnerabilities CVE-2026-59083 and CVE-2026-59084 have been disclosed affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options.

• CVE-2026-59084 is based on insufficient technical documentation of the EncryptInterceptor. However, this interceptor is not used inside DMC in the default configuration or any customer configuration known to us. Therefore, to the best of our knowledge, we do not expect DMC to be affted by this vulnerability.
• CVE-2026-59083 is based on incorrect decoding of input data in Tomcat's RewriteValve component. As far as we can ascertain, this component is inactive in both containerized and standalone deployments of DMC and it is therefore not affected by this issue.

Nonetheless, we are now releasing an updated version 2026.1.3 of Data Management Center that includes a patched version of the PostgreSQL JDBC driver and of Apache Tomcat.

Please note that the patch only secures Tomcat in containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Resolve PostgreSQL type-inference error on DATE/NUMBER PK update

(since 2026.1.2)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:0a67951c96aa54e039db2a6bc3eafb648642a1363111ceb0ad97da1ca992c08a

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.3/dmc.war (sha256: 754a812f1f8c12efde032749d7da2cf151e1f5c65083be2a081f6bc19ef753d4)

CVEs Tomcat​

Two separate vulnerabilities CVE-2026-55276 and CVE-2026-53434 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2026.1.2 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

(since 2026.1.1)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:e037b8b410760e484879e90e9d0a132c373eaf1b512ed70dd292e6ecfc5e5f9e WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.2/dmc.war (sha256: 9aaf9998a1c2e57782921e1394921f2f263d29484d88820a008fad6d0dae109e)

CVE Jackson-Databind​

Two vulnerabilities CVE-2026-54512 and CVE-2026-54513 have been disclosed affecting jackson-databind, which is used by the INFOMOTION Data Management Center (DMC). The DMC package ships with Jackson components that are used across all deployment options.

We are therefore releasing an updated version 2026.1.1 of Data Management Center that includes a patched version of jackson-databind.

(since 2026.1.0)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:d186e02db3a748e0bab4521b3df1a93879275b3742756b61883a5d412ffd48d3

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.1/dmc.war (sha256: cfa1e5079af802ff2fc4d679b2e168bcd3a0483d960e8fee45bc4eddd1451475)

Major Improvements to Data Quality engine​

We've made a number of improvements to the Data Quality engine, centered around caching the results of the latest DQ checks in the DMC backend database.

• Violations detected during the latest execution of each DQ rule are cached in the dmc_dq_rule_violation_cache table.

• Users now see only the DQ violations for rows they are allowed to see based on row-level permission. This extends even to the DQ dashboard view.

  info

  Note that Commands with a DQ violation policy still check all records, regardless of row-level permissions

• Performance of showing rows filtered by DQ status has been greatly improved.

• Table viewer performance has also been improved for large tables by fetching only violations for records on the current page.

• Rule executions are logged in the table dmc_dq_rule_executions. Automatic cleanup of old entries can be configured, see Variables

• DQ rules can now be configured for delta refresh: when enabled, only rows changed since the last successful run are checked instead of a full sweep over all active data. See Manage DQ-Rules for details.

• Configuration variables have been re-named from "DMC_QS_..." to "DMC_DQ_..."

Other Improvements​

• Increase table and column name length limit to 60 chars
• Disable invalid domainValues - show tooltip instead
• Show tooltip with reason why domain value is invalid
• Consistently disable required/writable for PK columns
• Table Viewer: improve performance by making inline editor load lazily
• Make search more responsive by decreasing debounce time
• Allow entering seconds in Date/Time input controls
• Improved display of import errors during DeploymentSet import
• Update included libraries/frameworks to recent major/minor versions

Bugfixes​

• Fix potential SQL injection by Table Admins via data permission filters

• Datetime & Date domains did not work properly

• Domain values of type Date/Time are badly formatted in filters

• Fix Domain-Suggestions for Dates/Datetimes

• Fix initial value for "Suggestion" values

• Invalid state after first DQ rule execution

• Normalize global search term for in-memory and db-based tables

• Sidebar was not refreshed on table information change

• Frontend did not display datatype 'flag' values correctly (1: true, 0: false, null -> null)

(since 2025.2.9)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:531a479b3f0c43bef88633f5686382234218f7490eff014eae711d43591c1628

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.0/dmc.war (sha256: f42674c338b9369a64ef5d868686be235dda1251fc6dc1557416463dc95c11d9)