36 Posts getaggt mit "LTS"

CVE Jackson-Databind​

Two vulnerabilities CVE-2026-54512 and CVE-2026-54513 have been disclosed affecting jackson-databind, which is used by the INFOMOTION Data Management Center (DMC). The DMC package ships with Jackson components that are used across all deployment options.

We are therefore releasing an updated version 2025.2.10 of Data Management Center that includes a patched version of jackson-databind.

(since 2025.2.9)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:ff015d956aac9964fea382af1ccf88a2a4037b8c564e6fa2aa6f4cd135ccfcd4

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.10/dmc.war (sha256: 0161c75aaa3c2de7ceeda13d836a280bbf6221c4a321b28b9423795585d803e1)

CVE Apache Shiro​

A vulnerability CVE-2026-49268 has been disclosed affecting Apache Shiro, which is used by the INFOMOTION Data Management Center (DMC).

We are therefore releasing an updated version 2025.2.9 of Data Management Center that includes Apache Shiro 2.2.1, which resolves this issue.

Bugfixes​

• fix: Adding checkbox columns after table creation threw exception on Postgres & Oracle

(since 2025.2.8)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:d74bb3efcf4af4151311131fcf52c869679c6b7551ec45000c035c5e91d55e42

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.9/dmc.war (sha256: 380613b56eb5d403121f335f8e2e69dec8afbfab066b9339e0366c92051fbbf6)

CVE Spring Framework​

Three vulnerabilities CVE-2026-41851, CVE-2026-41842, and CVE-2026-41850 have been disclosed, affecting the Spring Framework. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis, we do not believe Data Management Center to be impacted by these vulnerabilities. Two of them (CVE-2026-41851 and CVE-2026-41850) affect applications that evaluate user-supplied Spring Expression Language (SpEL) expressions, which DMC does not support. The third (CVE-2026-41842) affects applications making use of Spring's versioned static resource handling, which DMC does not employ.

Nonetheless, we are now releasing an updated version 2025.2.8 of Data Management Center that includes a patched version of the Spring Framework.

Features​

• Snowflake merge inline threshold and insert chunk size are now configurable via environment variables (DMC_SNOWFLAKE_MERGE_INLINE_THRESHOLD, DMC_SNOWFLAKE_INSERT_CHUNK_SIZE)

Bugfixes​

• Snowflake sync no longer fails on very large tables
• Table filters now work correctly for date, boolean column types on Postgres
• Eliminated race condition when inserting categories that could cause data corruption under concurrent load
• Table title and category name now update correctly in the navbar after a rename
• Sidebar now refreshes correctly when category information changes
• Category insert and update requests are now serialized to preserve input order and prevent duplicate sort_order values under concurrent inserts

Performance​

• Snowflake sync is now properly batched significantly reducing load for large sync operations
• Bulk merge import is significantly faster on large tables
• CSV/Excel import performance is substantially improved for large tables when data permissions are active
• Fixed stale data permission checks, when table-level permissions were disabled

(since 2025.2.7)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:645fbadbea16fd6e80de70e1b531b0783dcaa931cd77ac946c23712fbf831d18

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.8/dmc.war (sha256: a729519aa7f116ef22d5ee0150b8ce9fe77964f74756a65ab59e516ddf79ed51)

Two vulnerabilities CVE-2026-42498 and CVE-2025-41284 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.7 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Fixed duplicate column name error caused by stale state in the create-table form

• Fixed JSON parse exception in Snowflake environments when updating data permissions

(since 2025.2.6)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:2c1426feea2bd6c14ecfa20d364256b6052b76c67f51132a92af7a83e8c8d7c6

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.7/dmc.war (sha256: c56a4e10ddb2ca36eb797f06bc5c126da79aa0584e95f85199ae27b60bc9635a)

CVEs Spring Boot​

Several vulnerabilities have been disclosed affecting the Spring Boot framework:

• CVE-2026-40972
• CVE-2026-40973
• CVE-2026-40975
• CVE-2026-40976

A version of the Spring Boot framework is included in the INFOMOTION Data Management Center package and used across all deployment options.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2025.2.6 of Data Management Center that includes a patched version of the Spring Framework.

CVE Postgres​

Additionally, a vulnerability in the PostgreSQL JDBC Driver (pgJDBC) has been disclosed under CVE-2026-42198. The vulnerability affects pgJDBC versions from 42.2.0 up to, but not including, 42.7.11 and enables a client-side Denial of Service during SCRAM-SHA-256 authentication.

A version of PostgreSQL JDBC Driver is included in the INFOMOTION Data Management Center package and used across all deployment options.

Based on our analysis, the vulnerability requires SCRAM-SHA-256 to be the active authentication method on the PostgreSQL server. Deployments not using SCRAM-SHA-256 authentication are not affected by this CVE.

Nonetheless, we are now releasing an updated version 2025.2.6 of Data Management Center that includes a patched version of the PostgreSQL JDBC Driver (42.7.11), which fully resolves the vulnerability regardless of the authentication method in use.

Bugfixes​

• Snowflake: Deleting a table no longer causes continuous background queries to Snowflake, which were incurring unnecessary costs
• Snowflake: Valid DQ rule conditions are now correctly validated instead of being incorrectly rejected
• Snowflake: Numeric precision, scale and string length of columns are now correctly preserved when synchronizing table structures to Snowflake
• Snowflake: The SNOWFLAKE_USERNAME environment variable is no longer incorrectly required when using OAuth authentication
• Column Management: Duplicate column name detection is now case-insensitive, preventing naming conflicts that would fail at the database level
• Column Management: SQL reserved word warnings no longer appear on display titles

Dependency Upgrades​

• Upgrade Spring Boot from 4.0.5 to 4.0.6.
• Upgrade Spring Framework from 7.0.5 to 7.0.6.
• Upgrade PostgreSQL JDBC Driver from 42.7.4 to 42.7.11.

(since 2025.2.5)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:7890639e02f36bac2218a029f9eecb26afe80ff72e0640c0d59b32f5c0071b2b WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.6/dmc.war (sha256: 2b511dc366aea94945d8dcdc35f4f33d427eef60de2938b93d8c1669f9983c83)

Several vulnerabilities have been disclosed affecting the open-source Log4j library:

• CVE-2026-34478
• CVE-2026-34480
• CVE-2026-34481

A version of Log4J is included in the INFOMOTION Data Management Center package and used across all deployment options. However, according to information available so far, only very specific Log4j components (XmlLayout, JsonTemplateLayout, Rfc5424Layout) of Log4j are affected, neither of which are used in the default configuration of INFOMOTION Data Management Center.

Nonetheless, we are now releasing an updated version 2025.2.5 of Data Management Center that includes a patched version of the Log4J dependency.

Bugfixes​

• Fix: Wildcard '*' for numeric data permissions

• fix: Duplicate name validation for tables and columns

(since 2025.2.4)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:679425375d3590a2e14e8f14e24930056768471d35d3ee710f7a890baeb35e37 WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.5/dmc.war (sha256: 9d4b88b27be5780cd3c1b8f8d5b5a8d545286b5f3674b323ef878e9f13c3f180)

CVEs Tomcat​

Several vulnerabilities CVE-2026-34487, CVE-2026-24880, CVE-2026-29146, CVE-2026-34483, CVE-2026-29145 and CVE-2026-29129 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.4 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE Spring Framework​

Additionally, one vulnerability in the Spring Framework CVE-2026-22731 has been disclosed. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2025.2.4 of Data Management Center that includes a patched version of the Spring Framework.

Bugfixes​

• Fix: Numeric fields with decimals now allow correct digit entry
• Fix: Disabled form fields now persist correctly after rebuilds
• Fix: UI now refreshes after category sort order changes
• Fix: UI now refreshes after table sort order changes
• Fix: domain-edit dialog showed incorrect validation icon state
• Fix: domain-edit dialog now revalidates SQL on domain value changes
• Fix: command-edit dialog now allows re-copying previously copied entries
• Fix: Mail task email validator now requires a full domain with TLD
• Fix: Mail task email input validation state now updates correctly

Improvements​

• Improvement: Added visual separators for category changes in the table-admin-view
• Improvement: Improved visibility of visual separators in the task-edit-view

(since 2025.2.3)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:e9c475c3285d459a171db180d024c7d162781beb56085f5afeea4c2134094688

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.4/dmc.war (sha256: a21945ca8c6510bff72380d74eb89d5b6d31fbebb43c0f75b56c33210feb005c)

Two vulnerabilities CVE-2026-24734 and CVE-2025-66614 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.15 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

(since 2024.2.14)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.15

Two vulnerabilities CVE-2026-24734 and CVE-2025-66614 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.3 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Fix: Suggested admin mapping (import-dialog) is now correctly displayed on Date, Filename, DateTime, Rownumber columns
• Fix: Missing English translations for Qs-Mail-Task-Form

(since 2025.2.2)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:e70a0ebe090ebaec02160451d975bde46c99c743406366494eedfd115e6c318c WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.3/dmc.war (sha256: bfd86054cd14e7c2674de88d4231ee31cf97931c5648a08b421d88ac0e41a04e)

A patched version of the Jackson libraries is included in the upcoming INFOMOTION Data Management Center (DMC) release 2025.2. The DMC package ships with Jackson components that are used across all deployment options. We are now releasing Data Management Center 2025.2.2 with updated Jackson dependencies to address the security vulnerability CVE-2026-29062, which affected the bundled versions of jackson-databind and jackson-core.

(since 2025.2.1)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:a79361d65d07d2ef3c7159e7e20c7a2bd267ceafe11a779d9b51c81b09e7224a WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.2/dmc.war (sha256: 5f7b4c446309b1d428114a918ab312f9c236914ebc538741a710341b7f4ad2b1)

Bugfixes​

• Fixed a potential ConcurrentModificationException when QS rules were executed in parallel.

(since 2024.2.13)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.14

Bugfixes​

• Fixed a potential ConcurrentModificationException when QS rules were executed in parallel.
• Fixed an issue where permission caches were not initialized during application startup.
• Prevented duplicate table selections in the Admin Command and Admin QS views while filtering.
• Fixed incorrect sortId values for tables after category changes.

Improvements​

• Added validation to prevent duplicate column names and titles when creating or updating columns.

(since 2025.2.0)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:3dd4bdf43285aa981e7c387907caf4cc1468f393a37f6f693f6d193eb9812e3c

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.1/dmc.war (sha256: 842f632578726d6d91a56402351a5650531cbb0e708199e63e712d1f2e5c530b)

Features​

• Add Postgres DB support
• Add support for synchronizing column and table deletions in Snowflake.

Bugfixes​

• Fix: incorrect error handling when importing metadata packages with inconsistencies
• Fix: Don't create Deployment Set during import package validation
• Fix: Exporting Application could cause IndexOutOfBounds-Exception
• Fix: Allow editing when domain values are invalid by showing outdated entries...
• Fix: Deleting a category did not trigger UI refresh

Improvements​

• Users can now save changes directly in multi-edit mode without navigating...
• Restrict TablePermController Endpoints to users with GRANT Permission
• Improved performance of Create-Table-Process

(since 2025.1.5)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:c1d02d17db47aa1d394b7710bd644e52a110e400d9b46571538ee56015066d1e

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.0/dmc.war (sha256: c02f4fd250d8ce3133ab3f7eff3c9ff32a7aacb949ace5b1bd0fd14ea0a68c49)

With the release of DMC version 2025.2 with long-term-support (LTS), the previous LTS version 2024.2 is reaching it's end of life.

We will continue to offer security patches until 15.03.2026 to give customers time to upgrade to the new 2025.2 LTS release.

Two vulnerabilities CVE-2025-55752 and CVE-2025-55754 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.13 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

(since 2024.2.12)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.13

A version of the Microsoft JDBC Driver for SQL Server is included in the INFOMOTION Data Management Center package and used across all deployment options. We are now releasing an updated version 2024.2.12 of Data Management Center that includes a patched version of the Microsoft JDBC Driver for SQL Server to address CVE-2025-59250.

Bugfixes​

• Fix: Table-UI (List of tables) did not update when a table was deleted

(since 2024.2.11)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.12

CVE-2025-41242​

A vulnerability in the Spring Framework CVE-2025-41249 has been reported. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2024.2.11 of Data Management Center that includes a patched version of the Spring Framework.

Dependency Upgrades​

• Upgrade Spring Boot from 6.2.10 to 6.2.11.

Features​

• Added ENV Parameter DMC_TRIM_ALL_NON_PKS to trim all non-primary-key fields.

Bugfixes​

• Ensured proper rollback of caches when DeploymentSet import fails due to exceptions.
• Fixed incorrect validation in Trigger Form.
• Fixed incorrect validation in Task Form.
• Fixed translation error in Table-View.
• Resolved error in Admin-Task-View caused by invalid commands missing a tableId. Added a tooltip to indicate when a command is invalid and will not be scheduled.
• Improved error message for Objects not found: COMMAND #-2147483648 when deleting a command referenced by a task.
• Editing is now possible when domain values are invalid; outdated entries (not part of the list of values) are shown with a warning.
• Fixed issue where entries could not be deleted if a primary key field was set to null.
• Scheduled commands that fail due to a missing command are now automatically unscheduled.

(since 2024.2.10)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.11

CVE-2025-48989​

A vulnerability CVE-2025-48989 has been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.10 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE-2025-41242​

A vulnerability CVE-2025-41242 has been disclosed, affecting certain Spring Framework MVC applications in non-compliant servlet environments.

The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.
We are now releasing an updated version 2024.2.10 of Data Management Center that includes a patched version of Spring Framework.

Please note:

• Deployments of DMC using the embedded Tomcat servlet container are not affected by this vulnerability, since Tomcat properly rejects malicious path sequences.
• Nevertheless, we include the patched Spring Framework in this release to ensure ongoing security and compatibility.
• If DMC is deployed within a custom servlet container, that environment should be checked and updated accordingly.

Dependency Upgrades​

• Upgrade Tomcat from 10.1.43 to 10.1.44 to avoid potential issues with CVE-2025-48989.
• Upgrade Spring Boot from 6.2.8 to 6.2.10 to avoid potential issues with CVE-2025-41242

Bugfixes​

• Fixed an issue where List-of-Values without a filterColumn failed with cryptic errors.
• Fixed an issue where the checkmark on the update view is shows the incorrect state.
• Fixed an issue where QS rules were not revalidated when the table changes, which resulted in invalid SQLs.
• Fixed an issue where commands configured with QA CHECK BEFORE EXECUTION and Abort on error failed with a INTERNAL_SERVER_ERROR if no QA rules were defined.
• Fixed a header configuration error within table/{tableId}/data/delete.
• Prevented use of SQL keywords in columnName or title during Create-Table-Process.
• Fixed cryptic errors in the TablePerm workflow.
• Fixed a deserialization error for table permissions during the create process.
• Fixed an issue where the view did not update after importing a Deployment Set.
• Fixed an issue where attempting to rename a column during deployment-import lead to cryptic error message

Improvements​

• Enhanced Field descriptions within Input-Data fields.

(since 2024.2.9)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.10

Two separate vulnerabilities CVE-2025-53506 and CVE-2025-52520 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.9 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Dependecy Upgrades​

• Upgrade to Spring Boot 3.4.8 including embedded Tomcat 10.1.43 to avoid potential issues with CVE-2025-53506 and CVE-2025-52520

(since 2024.2.8)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.9

A vulnerability CVE-2025-48988 has been disclosed, affecting the Tomcat Web Application Server:
"DoS in multipart upload"

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.8 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that Tomcat installation should be patched as well.

Dependency Upgrades​

• Upgrade to Spring Boot 3.4.7 including embedded Tomcat 10.1.42 to avoid potential issues with CVE-2025-48988

(since 2024.2.7)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.8