65 Posts getaggt mit "Release"

CVE-2025-41242​

A vulnerability in the Spring Framework CVE-2025-41249 has been reported. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2024.2.11 of Data Management Center that includes a patched version of the Spring Framework.

Dependency Upgrades​

• Upgrade Spring Boot from 6.2.10 to 6.2.11.

Features​

• Added ENV Parameter DMC_TRIM_ALL_NON_PKS to trim all non-primary-key fields.

Bugfixes​

• Ensured proper rollback of caches when DeploymentSet import fails due to exceptions.
• Fixed incorrect validation in Trigger Form.
• Fixed incorrect validation in Task Form.
• Fixed translation error in Table-View.
• Resolved error in Admin-Task-View caused by invalid commands missing a tableId. Added a tooltip to indicate when a command is invalid and will not be scheduled.
• Improved error message for Objects not found: COMMAND #-2147483648 when deleting a command referenced by a task.
• Editing is now possible when domain values are invalid; outdated entries (not part of the list of values) are shown with a warning.
• Fixed issue where entries could not be deleted if a primary key field was set to null.
• Scheduled commands that fail due to a missing command are now automatically unscheduled.

(since 2024.2.10)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.11

CVE-2025-41242​

A vulnerability in the Spring Framework CVE-2025-41249 has been reported. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2025.1.3 of Data Management Center that includes a patched version of the Spring Framework.

Dependency Upgrades​

• Upgrade Spring Boot from 6.2.10 to 6.2.11.

Features​

• Added ENV Parameter DMC_TRIM_ALL_NON_PKS to trim all non-primary-key fields.

Bugfixes​

• Ensured proper rollback of caches when DeploymentSet import fails due to exceptions.
• Fixed incorrect validation in Trigger Form.
• Fixed incorrect validation in Task Form.
• Fixed translation error in Table-View.
• Resolved error in Admin-Task-View caused by invalid commands missing a tableId. Added a tooltip to indicate when a command is invalid and will not be scheduled.
• Improved error message for Objects not found: COMMAND #-2147483648 when deleting a command referenced by a task.
• Editing is now possible when domain values are invalid; outdated entries (not part of the list of values) are shown with a warning.
• Fixed issue where entries could not be deleted if a primary key field was set to null.
• Scheduled commands that fail due to a missing command are now automatically unscheduled.

(since 2025.1.2)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:bd1d896e0ff996c19ebcb9bb197db5905b213eb4636721921e15fc4ca7b6d202 WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.1.3/dmc.war (sha256: 2246bdebba17989ad468f89433f4bb5fe21e09a8973273f923ac00e8623c2d4c)

CVE-2025-48989​

A vulnerability CVE-2025-48989 has been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.10 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE-2025-41242​

A vulnerability CVE-2025-41242 has been disclosed, affecting certain Spring Framework MVC applications in non-compliant servlet environments.

The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.
We are now releasing an updated version 2024.2.10 of Data Management Center that includes a patched version of Spring Framework.

Please note:

• Deployments of DMC using the embedded Tomcat servlet container are not affected by this vulnerability, since Tomcat properly rejects malicious path sequences.
• Nevertheless, we include the patched Spring Framework in this release to ensure ongoing security and compatibility.
• If DMC is deployed within a custom servlet container, that environment should be checked and updated accordingly.

Dependency Upgrades​

• Upgrade Tomcat from 10.1.43 to 10.1.44 to avoid potential issues with CVE-2025-48989.
• Upgrade Spring Boot from 6.2.8 to 6.2.10 to avoid potential issues with CVE-2025-41242

Bugfixes​

• Fixed an issue where List-of-Values without a filterColumn failed with cryptic errors.
• Fixed an issue where the checkmark on the update view is shows the incorrect state.
• Fixed an issue where QS rules were not revalidated when the table changes, which resulted in invalid SQLs.
• Fixed an issue where commands configured with QA CHECK BEFORE EXECUTION and Abort on error failed with a INTERNAL_SERVER_ERROR if no QA rules were defined.
• Fixed a header configuration error within table/{tableId}/data/delete.
• Prevented use of SQL keywords in columnName or title during Create-Table-Process.
• Fixed cryptic errors in the TablePerm workflow.
• Fixed a deserialization error for table permissions during the create process.
• Fixed an issue where the view did not update after importing a Deployment Set.
• Fixed an issue where attempting to rename a column during deployment-import lead to cryptic error message

Improvements​

• Enhanced Field descriptions within Input-Data fields.

(since 2024.2.9)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.10

CVE-2025-48989​

A vulnerability CVE-2025-48989 has been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.1.2 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE-2025-41242​

A vulnerability CVE-2025-41242 has been disclosed, affecting certain Spring Framework MVC applications in non-compliant servlet environments.

The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.
We are now releasing an updated version 2025.1.2 of Data Management Center that includes a patched version of Spring Framework.

Please note:

• Deployments of DMC using the embedded Tomcat servlet container are not affected by this vulnerability, since Tomcat properly rejects malicious path sequences.
• Nevertheless, we include the patched Spring Framework in this release to ensure ongoing security and compatibility.
• If DMC is deployed within a custom servlet container, that environment should be checked and updated accordingly.

Dependency Upgrades​

• Upgrade Tomcat from 10.1.43 to 10.1.44 to avoid potential issues with CVE-2025-48989.
• Upgrade Spring Boot from 6.2.8 to 6.2.10 to avoid potential issues with CVE-2025-41242

Bugfixes​

• Fixed an issue where List-of-Values without a filterColumn failed with cryptic errors.
• Fixed an issue where the checkmark on the update view is shows the incorrect state.
• Fixed an issue where QS rules were not revalidated when the table changes, which resulted in invalid SQLs.
• Fixed an issue where commands configured with QA CHECK BEFORE EXECUTION and Abort on error failed with a INTERNAL_SERVER_ERROR if no QA rules were defined.
• Fixed a header configuration error within table/{tableId}/data/delete.
• Prevented use of SQL keywords in columnName or title during Create-Table-Process.
• Fixed cryptic errors in the TablePerm workflow.
• Fixed a deserialization error for table permissions during the create process.
• Fixed an issue where the view did not update after importing a Deployment Set.
• Fixed an issue where attempting to rename a column during deployment-import lead to cryptic error message

Improvements​

• Enhanced Field descriptions within Input-Data fields.

(since 2025.1.1)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:2393a32c3c7bfa9c93813a3bd932f5eb0315fd283cba46481496c0a2d30b5c61 WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.1.2/dmc.war (sha256: 9738ab489ed60937bff5216b0311f3aee3d0296b642ecb260f58b00eb23f87f3)

Features​

• Snowflake/Snowpark Support (Beta)

Bugfixes​

• Fix NG0100 'changed after checked' frontend error in certain conditions
• Resolved multiple bugs in the Create Table process
• Fixed issue where commands configured with "QA CHECK BEFORE EXECUTION" and "Abort on error" failed with a 500 INTERNAL_SERVER_ERROR if no QA rules were defined
• Fixed issue where commands remained in "Executing" state if an exception occurred during the pre-command QA check, they now correctly transition to "Failed"

Improvements​

• Decoupled optional built-in "admin" user from database authentication
• Improved sorting of categories, tables, and columns
• Enhanced flexibility of saved column mappings in uploads
• Refined Create Table Excel/CSV import workflow for better handling of headers, footers, and delimiters in Excel files

(since 2024.2.8)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:17034920c948a986eb8090fe1511922a41a5517c5498eb2695c87ea2b09fceb2

WAR File: https://dmcwiki.blob.core.windows.net/dmc-releases/2025.1.0/dmc.war (sha256: c2c0bd044f43623bcc63bb1877e3d63f317a18e7dbd79b51e9588c8716156a0e)

A vulnerability CVE-2025-48988 has been disclosed, affecting the Tomcat Web Application Server:
"DoS in multipart upload"

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.8 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that Tomcat installation should be patched as well.

Dependency Upgrades​

• Upgrade to Spring Boot 3.4.7 including embedded Tomcat 10.1.42 to avoid potential issues with CVE-2025-48988

(since 2024.2.7)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.8

The Spring project has published a Security Advisory concerning Spring Framework, an open-source library used by INFOMOTION Data Management Center.

Based on our analysis and the available information, the relevant vulnerability CVE-2025-41234 does not affect INFOMOTION Data Management Center since our application does not prepare headers using org.springframework.http.ContentDisposition.

Nonetheless, we are publishing a Patch Release of Data Management Center with an updated & fixed version of Spring Framework.

Dependency Upgrades​

• Upgrade to Spring Framework from 6.2.5 to 6.2.8 to avoid potential issues with CVE-2025-41234

(since 2024.2.6)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.7

Bugfixes​

• Properly load previously defined triggers on application startup
• Execute scheduled tasks as system user to avoid permissions errors
• Fix behaviour for very-high-precision numbers on MSSQL

(since 2024.2.5)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.6

Two separate vulnerabilities CVE-2025-31650 and CVE-2025-31651 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.5 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Dependecy Upgrades​

• Upgrade to Spring Boot 3.4.5 including embedded Tomcat 10.1.40 to avoid potential issues with CVE-2025-31650 and CVE-2025-31651

(since 2024.2.4)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.5

Bugfixes​

• Upgrade to Spring Boot 3.4.4 including embedded Tomcat 10.1.39 to avoid potential issues with CVE-2025-24813

(since 2024.2.3)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.4

Bugfixes​

• Allow users to choose .xlsm files for upload

• Use base image containing shell & mkdir for DMC container build

(since 2024.2.2)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.3

Bugfixes​

• Properly report all columns if multiple required columns are missing

(since 2024.2.1)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.2

Bugfixes​

• Avoid error message when uploading files with duplicate (case-insensitive) column name
• Fix error when displaying all QS violations with QS rules containing placeholders
• Container Image only: Update included Java Runtime Environment (JRE) to 17.0.14 fixing CVE-2025-21502

(since 2024.2.0)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.1

Bugfixes​

• Proper validation of empty primary keys during file import
• Fix rare frontend error when editing table properties with empty description
• Revert paginator to show row numbers instead of page numbers
• Avoid potential deadlocks when deleting many cached objects at once...
• Avoid various (transient) error messages when deleting many tables at once
• Remove swagger-ui due to CVE-2024-45801
• Apply default column mappings case-insensitive
• Fix an error occurring when sorting by hist_from in specific cases for MSSQL database
• Fix permissions check when editing table/data permissions
• Increase maximum number of decimal digits when using embedded H2 database

Improvements​

• Allow copying table columns
• Ensure usernames are only logged at DEBUG or TRACE level
• Built-in database ("db") authentication disabled by default
• Frontend improvements for long-running operations (delete multiple tables, import deployment set)
• Additional logging for file imports
• Allow at least partial startup & debug output when configuration is missing
• Allow removal of the last filter

(since 2024.1.6)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.0

Bugfixes​

• Revert paginator to show row numbers instead of page numbers

• Upgrade Spring Framework out of caution relating to CVE-2024-38819

(since 2024.1.5)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.6

Bugfixes​

• Avoid potential deadlocks when deleting many cached objects at once...
• Avoid various (transient) error messages when deleting many tables at once
• Fix NG0100 'changed after checked' frontend error in certain conditions

Improvements​

• Frontend improvements for long-running operations (delete multiple tables, import deployment set)

(since 2023.2.7)

Docker-Image: infomotiondmc.azurecr.io/dmc:2023.2.8

Bugfixes​

• Avoid potential deadlocks when deleting many cached objects at once...
• Avoid various (transient) error messages when deleting many tables at once
• Fix NG0100 'changed after checked' frontend error in certain conditions

Improvements​

• Frontend improvements for long-running operations (delete multiple tables, import deployment set)

(since 2024.1.4)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.5

Bugfixes​

• Remove unneccessary swagger-ui dependency due to CVE-2024-45801

• Make default column mappings case-insensitive (like all column mappings)

(since 2023.2.6)

Docker-Image: infomotiondmc.azurecr.io/dmc:2023.2.7

Bugfixes​

• Remove unneccessary swagger-ui dependency due to CVE-2024-45801

(since 2024.1.3)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.4

Bugfixes​

• Make default column mappings during import case-insensitive like all other import mappings

• Fix an error occurring when sorting by hist_from in specific cases for MSSQL database

(since 2024.1.2)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.1.3