Upgrade GeoServer for vulnerabilities #465

tlvu · 2024-07-11T03:10:04Z

Overview

GeoServer: upgrade to 2.25.2 to fix vulnerabilities

See:

This change will upgrade to GeoServer 2.25.2 and GeoTools 31.2 (the version of gt-complex.jar).

$ docker exec -u 0 geoserver find / -iname '**gt-complex**'
/usr/local/tomcat/webapps/geoserver/WEB-INF/lib/gt-complex-31.2.jar

The previous version was GeoServer 2.22.2 and GeoTools 28.2.

$ docker exec -u 0 geoserver find / -iname '**gt-complex**'
/usr/local/tomcat/webapps/geoserver/WEB-INF/lib/gt-complex-28.2.jar

Also enable

OGC-API plugins https://docs.geoserver.org/stable/en/user/community/ogc-api/features/index.html
so we can slowly transition from the WPS plugin.
STAC Datastore plugin https://docs.geoserver.org/latest/en/user/community/stac-datastore/index.html
so we can test integration with our STAC component.

Test result: jenkins-console-output.txt

Changes

Non-breaking changes

Upgrade GeoServer to 2.25.2
Enable additional GeoServer plugins

birdhouse_daccs_configs_branch: master
birdhouse_skip_ci: false

https://nsfocusglobal.com/remote-code-execution-vulnerability-between-geoserver-and-geotools-cve-2024-36401-cve-2024-36404-notification/ GHSA-6jj6-gm7p-fcvv GHSA-w3pj-wh35-fq8w Scope of Impact Affected Version GeoServer < 2.23.6 2.24.0 <= GeoServer < 2.24.4 2.25.0 <= GeoServer < 2.25.2 GeoTools < 29.6 31.0 <= GeoTools < 31.2 30.0 <= GeoTools < 30.4 Unaffected version GeoServer >= 2.23.6 GeoServer >= 2.24.4 GeoServer >= 2.25.2 GeoTools >= 29.6 GeoTools >= 30.4 GeoTools >= 31.2 Mitigation Official upgrade 1. At present, a new version and security patch have been officially released to fix the above vulnerabilities. Please install updates for protection as soon as possible. Download link: https://github.com/geoserver/geoserver/tags https://github.com/geotools/geotools/tags 2. You can download the patch versions 2.25.1, 2.24.3, 2.24.2, 2.23.2, 2.21.5, 2.20.7, 2.20.4, 2.19.2, and 2.18.0 from https://geoserver.org to obtain the gt-app-schema, gt-complex, and gt-xsd-core jar files. Replace the corresponding files in WEB-INF/lib of the affected system for restoration. Other protective measures If relevant users cannot install updates temporarily, the following measures can be taken for temporary relief: Deleting the gt-complex-x.y.jar file in GeoServer (x.y is the version of GeoTools, such as gt-complex-31.1.jar in GeoServer 2.25.1) will remove vulnerable code from GeoServer, but may compromise some GeoServer functionality. When a gt-complex module is required by an extension in use, it may cause the GeoServer deployment to fail.

For testing migration to use these plugins as existing ones (wps-plugin, ...) will be deprecated. Theoretically these new plugins should be able to co-exist with the existing ones.

…ulnerability

tlvu · 2024-07-11T15:13:42Z

@huard @tlogan2000 FYI the new GeoServer is already live on our production, without waiting for this PR to be merged, so we are protected against the vulnerability. All the OGC-API plugins have been enabled if ever you guys want to test it out.

tlvu · 2024-07-11T15:15:17Z

@fmigneault I do not see the CI pipelline being triggered for this PR. Is there a problem on your side?

@fmigneault

https://docs.geoserver.org/latest/en/user/community/stac-datastore/index.html Per @fmigneault request.

…er-for-vulnerability

fmigneault · 2024-07-12T13:44:19Z

@tlvu I don't see issues in the CI. Not sure why it doesn't trigger.
@ldperron Do you have an idea?

fmigneault · 2024-07-12T13:54:25Z

All the OGC-API plugins have been enabled if ever you guys want to test it out.

Nice!

OGC API Maps seems to respond nicely:
https://pavics.ouranos.ca/geoserver/ogc/maps/v1/collections/public:HydroLAKES_poly/styles/polygon/map?f=html
OGC API Coverages works for some cases, and others not:
https://pavics.ouranos.ca/geoserver/ogc/coverages/v1/collections/Synthese2015:TempAnnObs/coverage?f=image%2Fgeotiff
OGC API Tiles also seem ok:
https://pavics.ouranos.ca/geoserver/ogc/tiles/v1/collections/public:CanVec_WaterBodies/styles/CanVec_WaterBodies/map/tiles/EPSG:4326?f=text%2Fhtml
OGC API Features seems to be missing a config somewhere to resolve the type:
https://pavics.ouranos.ca/geoserver/ogc/features/v1/collections?f=text%2Fhtml
They are however accessible:
https://pavics.ouranos.ca/geoserver/ogc/features/v1/collections/public%3Aglobal_admin_boundaries/items?f=application%2Fjson&limit=50
(obtained via the OGC API Stlyes endpoint with JSON format selected: https://pavics.ouranos.ca/geoserver/ogc/styles/v1/styles/global_admin_boundaries/metadata?f=html)

Overall, very promising support!

fmigneault

Very welcomed changes.
Just minor editorial comments.

fmigneault · 2024-07-12T13:55:30Z

CHANGES.md

+  https://nsfocusglobal.com/remote-code-execution-vulnerability-between-geoserver-and-geotools-cve-2024-36401-cve-2024-36404-notification/,
+  https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv,
+  https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w


Please make them as list items, easier to read after when the text is wrapped in HTML.

Done 03f0577

fmigneault · 2024-07-12T13:55:51Z

CHANGES.md

+  ```
+  $ docker exec -u 0 geoserver find / -iname '**gt-complex**'
+  /usr/local/tomcat/webapps/geoserver/WEB-INF/lib/gt-complex-31.2.jar
+  ```
+
+  The previous version was GeoServer 2.22.2 and GeoTools 28.2.
+
+  ```


Add the shell style.

Done 03f0577

fmigneault · 2024-07-12T13:56:32Z

birdhouse/components/geoserver/default.env

+export GEOSERVER_COMMUNITY_EXTENSIONS="geopkg-plugin,\
+ogcapi-coverages-plugin,ogcapi-dggs-plugin,ogcapi-features-plugin,ogcapi-images-plugin,\
+ogcapi-maps-plugin,ogcapi-styles-plugin,ogcapi-tiled-features-plugin,ogcapi-tiles-plugin,\
+stac-datastore-plugin"


Can they be placed line-by-line for easier readability?

Sure I can do this for other plugins that we will enable in the future. For the ogcapi bunch, I consider them as a "group" so I'd rather keep them on the same lines if you don't mind.

I think the "group" is more obvious with the "ogcapi-" prefix that would align on all lines when following each other.

Knowing you do not like long line, that's why I broke it down to 2 lines of "ogcapi-". Do you really want me to put it on one line?

Or I can keep 2 lines with a comment to group related plugins on the same line, else if they are unrelated, on different line for readability?

Since the ogcapi- items are already spread out across 2 lines because there are too many entries, I would rather have everything on their own line.

Also, just noticed that https://github.com/kartoza/docker-geoserver/blob/master/build_data/community_plugins.txt is still referenced above the variable. This is not valid anymore because they switched to develop branch with a new plugin download strategy. The old master reference only contains ogcapi-plugin as a whole, which is misleading. Maybe https://build.geoserver.org/geoserver/ should be used as reference instead.

Done in 6282c9c.

fmigneault · 2024-07-12T13:59:11Z

@tlvu
Manually triggered in the meantime:
http://daccs-jenkins.crim.ca/job/DACCS-iac-birdhouse/2729/

tlvu · 2024-07-12T16:33:31Z

@fmigneault FYI the STAC datastore that you requested is also live.

fmigneault · 2024-07-12T22:16:11Z

@tlvu

FYI the STAC datastore that you requested is also live.

Thanks. Good to know.
I won't be able to test it on your instance though since we need to create a new "data store" pointing to STAC as per https://docs.geoserver.org/latest/en/user/community/stac-datastore/install.html

Will try to find time to test it next week on a test instance.

…er-for-vulnerability

tlvu · 2024-07-18T16:49:13Z

@fmigneault Can you approuve so we can merge this PR if no critical blocking issue since this PR is to address a vulnerability so it has to be deployed fast. I think on CRIM and UofT side, you guys would also want to deploy this earlier than later. For other non-critical, I think we can address in subsequent PR.

tlvu added 4 commits July 9, 2024 15:34

geoserver: enable all ogcapi plugins for testing

5cc4848

For testing migration to use these plugins as existing ones (wps-plugin, ...) will be deprecated. Theoretically these new plugins should be able to co-exist with the existing ones.

Merge remote-tracking branch 'origin/master' into upg-geoserver-for-v…

a4ac8fe

…ulnerability

CHANGES: GeoServer 2.25.2 upgrade

1a23e12

tlvu requested review from fmigneault and mishaschwartz as code owners July 11, 2024 03:10

github-actions bot added component/geoserver Related to GeoServer or one of its underlying services documentation Improvements or additions to documentation labels Jul 11, 2024

tlvu added 2 commits July 11, 2024 14:59

geoserver: enable stac-datastore-plugin

63fbbc5

https://docs.geoserver.org/latest/en/user/community/stac-datastore/index.html Per @fmigneault request.

Merge remote-tracking branch 'origin/ouranos-deploy' into upg-geoserv…

faf6de5

…er-for-vulnerability

fmigneault reviewed Jul 12, 2024

View reviewed changes

CHANGES: update for readability (review feedback)

03f0577

tlvu requested a review from fmigneault July 12, 2024 16:33

fmigneault mentioned this pull request Jul 12, 2024

Publishing mechanism DACCS-Climate/roadmap#60

Open

tlvu added 2 commits July 18, 2024 12:39

geoserver: list extensions on separate line for readability

6282c9c

Merge remote-tracking branch 'origin/ouranos-deploy' into upg-geoserv…

60fbdb7

…er-for-vulnerability

fmigneault approved these changes Jul 18, 2024

View reviewed changes

Bump version: 2.5.1 → 2.5.2

a6011b1

github-actions bot added the ci/operations Continuous Integration components label Jul 19, 2024

tlvu merged commit 86ffba0 into master Jul 19, 2024
3 checks passed

tlvu deleted the upg-geoserver-for-vulnerability branch July 19, 2024 03:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade GeoServer for vulnerabilities #465

Upgrade GeoServer for vulnerabilities #465

tlvu commented Jul 11, 2024 •

edited

Loading

tlvu commented Jul 11, 2024

tlvu commented Jul 11, 2024

fmigneault commented Jul 12, 2024

fmigneault commented Jul 12, 2024

fmigneault left a comment

fmigneault Jul 12, 2024

tlvu Jul 12, 2024

fmigneault Jul 12, 2024

tlvu Jul 12, 2024

fmigneault Jul 12, 2024

tlvu Jul 12, 2024

fmigneault Jul 15, 2024

tlvu Jul 16, 2024

tlvu Jul 16, 2024

fmigneault Jul 16, 2024

tlvu Jul 18, 2024

fmigneault commented Jul 12, 2024

tlvu commented Jul 12, 2024

fmigneault commented Jul 12, 2024

tlvu commented Jul 18, 2024

Upgrade GeoServer for vulnerabilities #465

Upgrade GeoServer for vulnerabilities #465

Conversation

tlvu commented Jul 11, 2024 • edited Loading

Overview

Changes

tlvu commented Jul 11, 2024

tlvu commented Jul 11, 2024

fmigneault commented Jul 12, 2024

fmigneault commented Jul 12, 2024

fmigneault left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fmigneault commented Jul 12, 2024

tlvu commented Jul 12, 2024

fmigneault commented Jul 12, 2024

tlvu commented Jul 18, 2024

tlvu commented Jul 11, 2024 •

edited

Loading