32 Posts getaggt mit "Security"

A security advisory has been published for Apache FreeMarker, a template library included in the INFOMOTION Data Management Center (DMC).

CVE-2026-84939 (CVSS 9.1) is a path traversal vulnerability in FreeMarker's template loading mechanism: if an attacker can specify an arbitrary malformed locale identifier while the (by default enabled) localized lookup configuration is active, templates outside their intended directory may be loaded.

Relevance for DMC​

DMC uses FreeMarker templates only for generating the DQ-eMail. In that context the templates are maintained by an administrator within the application. Accordingly, the vulnerability can only be triggered by a user with administrator privileges in DMC, not by ordinary users.

Nonetheless, we are now releasing an updated version 2025.2.14 of Data Management Center that includes a patched version of the Apache FreeMarker library.

(since 2025.2.13)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:b6aebda947ab4ed2fbe8709602069bb84ee681ad8804b15b26396e7a0ae8e37f

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.14/dmc.war (sha256: 04606a0a4a8962820dbbc023ff6a3e2333e1572c992d69cc5ee61e65547f0bde)

Several vulnerabilities have been disclosed affecting the Tomcat Web Application Server:

• CVE-2026-65183
• CVE-2026-65905
• CVE-2026-65927
• CVE-2026-66422
• CVE-2026-68763
• CVE-2026-68525
• CVE-2026-68569
• CVE-2026-65182
• CVE-2026-65637

A version of Tomcat Web Application Server is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.13 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE Spring Framework​

A vulnerability CVE-2026-59313 has been disclosed, affecting the Spring Framework. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2025.2.13 of Data Management Center that includes a patched version of the Spring Framework.

(since 2025.2.12)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:9267ece363a0727c83cceffe813f5b3e0f5b70eb49d108a60e54490e83e5dca6

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.13/dmc.war (sha256: caeb1734fa51e9b19b0d642b18f12b88eda4a85f1553eb276f3869011d687d60)

Several vulnerabilities have been disclosed affecting the Tomcat Web Application Server:

• CVE-2026-65183
• CVE-2026-65905
• CVE-2026-65927
• CVE-2026-66422
• CVE-2026-68763
• CVE-2026-68525
• CVE-2026-68569
• CVE-2026-65182
• CVE-2026-65637

A version of Tomcat Web Application Server is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2026.1.4 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE Spring Framework​

A vulnerability CVE-2026-59313 has been disclosed, affecting the Spring Framework. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2026.1.4 of Data Management Center that includes a patched version of the Spring Framework.

(since 2026.1.3)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:88c57d5db23c8878c74677ce011f1564eb00c5eed7213afb861d07c345bd8b26

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.4/dmc.war (sha256: 0b8413b7c8708cc27267adb7d3aeca41e8e58c8573f02b0fa0ac8808c6583b10)

PostgreSQL JDBC Driver CVEs​

A vulnerability CVE-2026-54291 has been disclosed, affeting the PostgreSQL JDBC driver.

While the PostgreSQL driver is bundled with INFOMOTION Data Management Center, the vulnerability only affects very specific combinations of parameters and makes DMC installations using PostgreSQL potentially vulnerable to man-in-the-middle attackes on the connection to the backend database.

Additionally, two separate vulnerabilities CVE-2026-59083 and CVE-2026-59084 have been disclosed affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options.

• CVE-2026-59084 is based on insufficient technical documentation of the EncryptInterceptor. However, this interceptor is not used inside DMC in the default configuration or any customer configuration known to us. Therefore, to the best of our knowledge, we do not expect DMC to be affted by this vulnerability.
• CVE-2026-59083 is based on incorrect decoding of input data in Tomcat's RewriteValve component. As far as we can ascertain, this component is inactive in both containerized and standalone deployments of DMC and it is therefore not affected by this issue.

Nonetheless, we are now releasing an updated version 2025.2.12 of Data Management Center that includes a patched version of the PostgreSQL JDBC driver and of Apache Tomcat.

Please note that the patch only secures Tomcat in containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Resolve PostgreSQL type-inference error on DATE/NUMBER PK update

(since 2025.2.11)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:cf3645b093589aa6cecffef8d3ef2d0c8bd0875afd2a83c5398e90f527f7944d

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.12/dmc.war (sha256: bab76491204253b5a1364f556ab0b22a535601fa2ad357c4fbec329884504a7e)

PostgreSQL JDBC Driver CVEs​

A vulnerability CVE-2026-54291 has been disclosed, affeting the PostgreSQL JDBC driver.

While the PostgreSQL driver is bundled with INFOMOTION Data Management Center, the vulnerability only affects very specific combinations of parameters and makes DMC installations using PostgreSQL potentially vulnerable to man-in-the-middle attackes on the connection to the backend database.

Additionally, two separate vulnerabilities CVE-2026-59083 and CVE-2026-59084 have been disclosed affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options.

• CVE-2026-59084 is based on insufficient technical documentation of the EncryptInterceptor. However, this interceptor is not used inside DMC in the default configuration or any customer configuration known to us. Therefore, to the best of our knowledge, we do not expect DMC to be affted by this vulnerability.
• CVE-2026-59083 is based on incorrect decoding of input data in Tomcat's RewriteValve component. As far as we can ascertain, this component is inactive in both containerized and standalone deployments of DMC and it is therefore not affected by this issue.

Nonetheless, we are now releasing an updated version 2026.1.3 of Data Management Center that includes a patched version of the PostgreSQL JDBC driver and of Apache Tomcat.

Please note that the patch only secures Tomcat in containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Resolve PostgreSQL type-inference error on DATE/NUMBER PK update

(since 2026.1.2)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:0a67951c96aa54e039db2a6bc3eafb648642a1363111ceb0ad97da1ca992c08a

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.3/dmc.war (sha256: 754a812f1f8c12efde032749d7da2cf151e1f5c65083be2a081f6bc19ef753d4)

CVEs Tomcat​

Two separate vulnerabilities CVE-2026-55276 and CVE-2026-53434 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.11 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

(since 2025.2.10)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:5151d8046c59c5defb8f1d8e67db10176a1320d0ffdb17b7ee12546723f4db8c

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.11/dmc.war (sha256: e2e71e39c164784238ff5e65eef186783fe654650bf534d4307591c7c19038c6)

CVEs Tomcat​

Two separate vulnerabilities CVE-2026-55276 and CVE-2026-53434 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2026.1.2 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

(since 2026.1.1)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:e037b8b410760e484879e90e9d0a132c373eaf1b512ed70dd292e6ecfc5e5f9e WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.2/dmc.war (sha256: 9aaf9998a1c2e57782921e1394921f2f263d29484d88820a008fad6d0dae109e)

CVE Jackson-Databind​

Two vulnerabilities CVE-2026-54512 and CVE-2026-54513 have been disclosed affecting jackson-databind, which is used by the INFOMOTION Data Management Center (DMC). The DMC package ships with Jackson components that are used across all deployment options.

We are therefore releasing an updated version 2026.1.1 of Data Management Center that includes a patched version of jackson-databind.

(since 2026.1.0)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:d186e02db3a748e0bab4521b3df1a93879275b3742756b61883a5d412ffd48d3

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2026.1.1/dmc.war (sha256: cfa1e5079af802ff2fc4d679b2e168bcd3a0483d960e8fee45bc4eddd1451475)

CVE Jackson-Databind​

Two vulnerabilities CVE-2026-54512 and CVE-2026-54513 have been disclosed affecting jackson-databind, which is used by the INFOMOTION Data Management Center (DMC). The DMC package ships with Jackson components that are used across all deployment options.

We are therefore releasing an updated version 2025.2.10 of Data Management Center that includes a patched version of jackson-databind.

(since 2025.2.9)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:ff015d956aac9964fea382af1ccf88a2a4037b8c564e6fa2aa6f4cd135ccfcd4

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.10/dmc.war (sha256: 0161c75aaa3c2de7ceeda13d836a280bbf6221c4a321b28b9423795585d803e1)

CVE Apache Shiro​

A vulnerability CVE-2026-49268 has been disclosed affecting Apache Shiro, which is used by the INFOMOTION Data Management Center (DMC).

We are therefore releasing an updated version 2025.2.9 of Data Management Center that includes Apache Shiro 2.2.1, which resolves this issue.

Bugfixes​

• fix: Adding checkbox columns after table creation threw exception on Postgres & Oracle

(since 2025.2.8)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:d74bb3efcf4af4151311131fcf52c869679c6b7551ec45000c035c5e91d55e42

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.9/dmc.war (sha256: 380613b56eb5d403121f335f8e2e69dec8afbfab066b9339e0366c92051fbbf6)

CVE Spring Framework​

Three vulnerabilities CVE-2026-41851, CVE-2026-41842, and CVE-2026-41850 have been disclosed, affecting the Spring Framework. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis, we do not believe Data Management Center to be impacted by these vulnerabilities. Two of them (CVE-2026-41851 and CVE-2026-41850) affect applications that evaluate user-supplied Spring Expression Language (SpEL) expressions, which DMC does not support. The third (CVE-2026-41842) affects applications making use of Spring's versioned static resource handling, which DMC does not employ.

Nonetheless, we are now releasing an updated version 2025.2.8 of Data Management Center that includes a patched version of the Spring Framework.

Features​

• Snowflake merge inline threshold and insert chunk size are now configurable via environment variables (DMC_SNOWFLAKE_MERGE_INLINE_THRESHOLD, DMC_SNOWFLAKE_INSERT_CHUNK_SIZE)

Bugfixes​

• Snowflake sync no longer fails on very large tables
• Table filters now work correctly for date, boolean column types on Postgres
• Eliminated race condition when inserting categories that could cause data corruption under concurrent load
• Table title and category name now update correctly in the navbar after a rename
• Sidebar now refreshes correctly when category information changes
• Category insert and update requests are now serialized to preserve input order and prevent duplicate sort_order values under concurrent inserts

Performance​

• Snowflake sync is now properly batched significantly reducing load for large sync operations
• Bulk merge import is significantly faster on large tables
• CSV/Excel import performance is substantially improved for large tables when data permissions are active
• Fixed stale data permission checks, when table-level permissions were disabled

(since 2025.2.7)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:645fbadbea16fd6e80de70e1b531b0783dcaa931cd77ac946c23712fbf831d18

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.8/dmc.war (sha256: a729519aa7f116ef22d5ee0150b8ce9fe77964f74756a65ab59e516ddf79ed51)

Two vulnerabilities CVE-2026-42498 and CVE-2025-41284 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.7 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Fixed duplicate column name error caused by stale state in the create-table form

• Fixed JSON parse exception in Snowflake environments when updating data permissions

(since 2025.2.6)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:2c1426feea2bd6c14ecfa20d364256b6052b76c67f51132a92af7a83e8c8d7c6

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.7/dmc.war (sha256: c56a4e10ddb2ca36eb797f06bc5c126da79aa0584e95f85199ae27b60bc9635a)

Several vulnerabilities have been disclosed affecting the open-source Log4j library:

• CVE-2026-34478
• CVE-2026-34480
• CVE-2026-34481

A version of Log4J is included in the INFOMOTION Data Management Center package and used across all deployment options. However, according to information available so far, only very specific Log4j components (XmlLayout, JsonTemplateLayout, Rfc5424Layout) of Log4j are affected, neither of which are used in the default configuration of INFOMOTION Data Management Center.

Nonetheless, we are now releasing an updated version 2025.2.5 of Data Management Center that includes a patched version of the Log4J dependency.

Bugfixes​

• Fix: Wildcard '*' for numeric data permissions

• fix: Duplicate name validation for tables and columns

(since 2025.2.4)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:679425375d3590a2e14e8f14e24930056768471d35d3ee710f7a890baeb35e37 WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.5/dmc.war (sha256: 9d4b88b27be5780cd3c1b8f8d5b5a8d545286b5f3674b323ef878e9f13c3f180)

CVEs Tomcat​

Several vulnerabilities CVE-2026-34487, CVE-2026-24880, CVE-2026-29146, CVE-2026-34483, CVE-2026-29145 and CVE-2026-29129 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.4 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

CVE Spring Framework​

Additionally, one vulnerability in the Spring Framework CVE-2026-22731 has been disclosed. The INFOMOTION Data Management Center (DMC) includes the Spring Framework as part of its package.

Based on our analysis and existing automated tests of authorization procedures, we do not believe Data Management Center to be impacted by the vulnerability.

Nonetheless, we are now releasing an updated version 2025.2.4 of Data Management Center that includes a patched version of the Spring Framework.

Bugfixes​

• Fix: Numeric fields with decimals now allow correct digit entry
• Fix: Disabled form fields now persist correctly after rebuilds
• Fix: UI now refreshes after category sort order changes
• Fix: UI now refreshes after table sort order changes
• Fix: domain-edit dialog showed incorrect validation icon state
• Fix: domain-edit dialog now revalidates SQL on domain value changes
• Fix: command-edit dialog now allows re-copying previously copied entries
• Fix: Mail task email validator now requires a full domain with TLD
• Fix: Mail task email input validation state now updates correctly

Improvements​

• Improvement: Added visual separators for category changes in the table-admin-view
• Improvement: Improved visibility of visual separators in the task-edit-view

(since 2025.2.3)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:e9c475c3285d459a171db180d024c7d162781beb56085f5afeea4c2134094688

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.4/dmc.war (sha256: a21945ca8c6510bff72380d74eb89d5b6d31fbebb43c0f75b56c33210feb005c)

Two vulnerabilities CVE-2026-24734 and CVE-2025-66614 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.15 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

(since 2024.2.14)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.15

Two vulnerabilities CVE-2026-24734 and CVE-2025-66614 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2025.2.3 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

Bugfixes​

• Fix: Suggested admin mapping (import-dialog) is now correctly displayed on Date, Filename, DateTime, Rownumber columns
• Fix: Missing English translations for Qs-Mail-Task-Form

(since 2025.2.2)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:e70a0ebe090ebaec02160451d975bde46c99c743406366494eedfd115e6c318c WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.2.3/dmc.war (sha256: bfd86054cd14e7c2674de88d4231ee31cf97931c5648a08b421d88ac0e41a04e)

Two vulnerabilities CVE-2025-55752 and CVE-2025-55754 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.13 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.

(since 2024.2.12)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.13

Two vulnerabilities CVE-2025-55752 and CVE-2025-55754 have been disclosed, affecting the Tomcat Web Application Server.

A version of Tomcat is included in the INFOMOTION Data Management Center package and used for the containerized and standalone deployment options. We are now releasing an updated version 2024.2.13 of Data Management Center that includes a patched version of Apache Tomcat.

Please note that this patch only secures containerized or standalone DMC deployments. When deployed within a custom Tomcat installation, that installation should be patched as well.
(since 2025.1.4)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:6297c90cb72a67bcb6b1c8b8537b9f5bc82ff326292b73363d5ced718dd1b800

WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.1.5/dmc.war (sha256: 49402986017c752e665d4d674427bc8279a76c86d60521d311d9fb12c19d568a)

A version of the Microsoft JDBC Driver for SQL Server is included in the INFOMOTION Data Management Center package and used across all deployment options. We are now releasing an updated version 2024.2.12 of Data Management Center that includes a patched version of the Microsoft JDBC Driver for SQL Server to address CVE-2025-59250.

Bugfixes​

• Fix: Table-UI (List of tables) did not update when a table was deleted

(since 2024.2.11)

Docker-Image: infomotiondmc.azurecr.io/dmc:2024.2.12

A version of the Microsoft JDBC Driver for SQL Server is included in the INFOMOTION Data Management Center package and used across all deployment options. We are now releasing an updated version 2025.1.4 of Data Management Center that includes a patched version of the Microsoft JDBC Driver for SQL Server to address CVE-2025-59250.

Bugfixes​

• fix(import): Ensure upsert behavior when using custom primary key instead of insert-only
• fix: Table inMemory could not be updated due to JSON parsing discrepancy
• fix: Data page does not update on page change
• fix: Applying TableFilters caused IndexOutOfBounds-Error
• Fix: Table-UI (List of tables) did not update when a table was deleted

(since 2025.1.3)

Container Image: infomotiondmc.azurecr.io/dmc@sha256:5dcdb35ce61e2b08836b3125e54869d624f75f14f10d2e50feff9c6b47711a0e WAR File : https://dmcwiki.blob.core.windows.net/dmc-releases/2025.1.4/dmc.war (sha256: c44bad4cf8d894f25a01daf47c36f7bbd7f891107a691496885bf2b5a09a327b)