Log4J-1.12.x.jar - how to address the vulnerablity - security

Currently we have 200+ java-based application that are using the log4j-1.12.x version. Upgrading this in one shot will be next to impossible. Is there any other remediation available/suggested for this?

Related

Apiman 2.0.0 security vulnerabilities

We have passed Apiman-2.0.0.final through security scans and came up with some critical/high vulnerabilities, mostly relevant to keycloak-core-10.0.2.
Fixes for this vulnerability are available in higher versions of keycloak.
I would like to know how do you handle these scenarios.
Should we repackage the war locally for us to use? We can create a pull request if it works.
Should we open a Jira item? I cannot see 2.0.0 being supported on red hat Jira. https://issues.redhat.com/projects/APIMAN/summary
Please post issues on our GitHub issue tracker, not stack overflow https://github.com/apiman/apiman/issues
We're using a newer version of Keycloak for the upcoming community release. You can indeed use your own separate Keycloak instance (recommended for a real deployment), rather than the one bundled in the quickstart.

Why CTL doesn't work in ExecuteGroovyScript processor with Apache NiFi 1.10.0?

I've used CTL in ExecuteGroovyScript processor to connect to database which is selected by database.name due to this problem DBCPConnectionPoolLookup problem in ExecuteGroovyScript. after upgrading NiFi to new version (1.10.0), the processors show this error:
and this is my processor configuration:
Please let me know the problem.
I started testing version 1.10.0 myself recently and that was one of the things I ran in to as well. Try using SQL.* (ex: SQL.db) for your property name as that is used specifically for DBCP services. If you need to access other services that still can be done by looking up the service by name in your Groovy script as a workaround but based on Jira activity, I see this bug is already being worked on and hopefully will be fixed in next release. I hope this helps.

Is it possible to update node-weblit based application without new installation?

I'm plan to release my web application under node-webkit platform and allow users to install it on their local machine. But before, I need to understand how will I update this application?
I see the following two approaches:
Download a new version of new application and replace older one
Autoupdate node-webkit application like Google Chrome does (so users don't need to do anything except rebooting application).
I'm very interested how should I do the second approach? Could you share your experience with maintaining of your node-webkit based applications?
Thanks!

sitecore azure module 3.0.0 slow

We are using Sitecore Azure module version 3.0.0. We have noticed that it's very slow and stops (hangs) working when deploying db and source files to azure.
Has anyone experienced that and is there any workaround?
We are using Sitecore Azure module version 3.0.0. but with Sitecore 7.
Deployment from my PC takes about an hour. On my internet connection uploading takes the most time.
Currently we're looking for a workaround. If we find I will update this answer.
I have experienced the same problem. It is almost certainly either: a network/connectivity issue OR, the database connection is timing out. I have blogged about troubleshooting both here: http://reservoirdevs.wordpress.com/2013/10/18/sitecore-azure-walkthrough-and-gotchas/

Migrate Liferay 5 -> 5.2

We have a liferay portal running on a hosting company, and We want to bring it to our own structure. So, I've downloaded the excellent bitnami stack and loaded it in our vmware server.
I've no experience on liferay whatsoever, all I know its that it uses mysql as database. Is there any docs on how to do it?
Tks!
Use the Liferay's Wiki:
5.0 to 5.1: http://www.liferay.com/community/wiki/-/wiki/Main/Upgrade+Instructions+from+5.0+to+5.1
5.1. to 5.2: http://www.liferay.com/community/wiki/-/wiki/Main/Upgrade+Instructions+from+5.1+to+5.2
I recommend to do a 2-step upgrade since direct upgrade from 5.0 to 5.2 is more troublesome.
There have been reports that it's some work to upgrade older versions to the latest and greatest, so you should be prepared for some efforts.
That said, the way you should go is to backup the previous installation (e.g. all directories, database entries etc) and deploy that on your own server. This installation then is updated to the latest version by installing the latest version and pointing it to the data from the previous installation. During the first startup, liferay will (given sufficient privileges on mysql) update the database structure and everything it needs. Keep your backup ready and test thoroughly if everything is upgraded the way you intended it to be.
Also you need to keep an eye on your customized stuff - if you have portlets or other components that use the liferay api, you might need to upgrade those manually to take changed APIs into account.
Theoretically that should be it. I've heard of people having had some problems with this - but it all depends on your level of customization and utilization of features in liferay.
The liferay folks intend to circumvent this in future with their EE environment, where you get better defined upgrade paths and long term support with minor upgrades to your environment, keeping APIs and database requirements stable. I'd hope that even upgrades between major versions will benefit from this, but have not yet tried it.

Resources