Release Notes

As of the release 2023.10, the following internally used software has been updated.

• Java Service Wrapper (configuration and monitoring of FirstSpirit Java VM, 3.5.50 --> 3.5.54)
  Note: When the FirstSpirit server is updated (auto-update, in-place upgrade), the Java Service Wrapper files are not automatically updated. The Java Service Wrapper can be updated via the tar gzip update archive (file fs-update-[version].tar.gz) as described in the FirstSpirit installation instructions.
  Additional documentation:
  • on Java Service Wrapper (manual for administrators)
  • on Updating the Java Service Wrapper (installation instructions)

With the help of a new parameter schedule.maxInactivityTimeout in fs-server.conf, it can be defined within which period of time a schedule task action is considered blocked and aborted if no CPU time has been consumed.

This metric makes it possible to identify threads or schedule task actions that are not using CPU resources within a specified period of time and to cancel them if necessary to optimise efficiency and resource use.

By default, this time frame is set to 10 minutes. A check for the termination condition is made every five minutes.

In exceptional cases, a thread in the standard configuration can therefore remain without CPU consumption for up to 15 minutes before it is recognised as blocked and terminated.

Due to CVE-2023-4863, the WebP library used by FirstSpirit has been updated to a version based on libwebp version 1.3.2.

A “heap buffer overflow” in WebP allowed a remote attacker to perform an out-of-bounds memory-write, and thus possibly inject malicious code. A manipulated WebP image can therefor lead to code injection.

How can the vulnerability be exploited?

• An editor adds a manipulated WebP image to a project.

What do you have to do?

• (Server) Update to 5.2.230813 (Non-Jakarta) or 5.2.231008 (Jakarta)
• (Client) Disable the integrated preview in SA (JxBrowser)
• (Client) Update the local browsers

Mitigation without FS Update

• (Server) Prevent uploading of WebP (set appropriate restrictions in the project) or
• (Server) Configure WebP as media type file
• (Client) Disable the integrated preview in SA (JxBrowser)
• (Client) Update the local browsers

For security reasons, it is no longer possible for server administrators for whom the “external user” option is not set to log in via external authentication (e.g. SAML or LDAP). An attempt to do so will now result in the login dialog being displayed.

This restriction does not apply to normal users and also not to project administrators.

Two new match modes for external groups have been introduced in the FirstSpirit SAML login module.

The new parameters can be defined in fs-saml.conf (see Installation and Setup of the Module).

group.match.mode

Possible values:

• contains (default value)
• equals

With this parameter, the assignment to external groups can be changed from “SAML group must contain the external designation of the group” (contains) to “SAML group must be identical to the external designation” (equals).

group.name

group.name=${saml:groupName}

With this parameter it is possible to extend the SAML group name by any prefix and/or suffix.

Example:

group.name=SAML-${saml:groupName}-GROUP

This configuration would result in a “users” group obtained via SAML login being used in FirstSpirit as a “SAML-users-GROUP”.

The migration to Jakarta Servlet 6.0 is an essential step to ensure the security of web applications.

With the FirstSpirit version 2023.9, the changeover to Jakarta Servlet 6.0 with support for automatic migration took place.

Support for automatic migration will be removed with FirstSpirit 2024.9.

In contrast to the phased rollout for cloud customers, on-premises customers are able to test and migrate their FirstSpirit servers once version 2023.9 or 2023.10 has been released.

Important:

• If FirstSpirit is run in an on-premises scenario, the Tomcat version must be updated when migrating to the FirstSpirit JakartaEE edition. Since the servlet version will be updated to 6.0, a 10.1.x version of Tomcat is required.
• The use of FirstSpirit version 2023.9 or newer requires that Java version 17 is used.

The FirstSpirit installation may be affected if any of the following conditions apply:

• The FirstSpirit installation is not maintained in the Crownpeak Cloud and deploys web-applications to an application server like Apache Tomcat.
• A custom module is used that contains a WebApp component with code that uses the legacy Java Servlet API.
• A custom module is used that contains a WebApp component with dependencies that use the old JavaEE API, e.g., Spring Boot 2.x.

More information and updates can be found in the Crownpeak Community and the detailed Jakarta FAQ.

Contact Customer Support Team if you have questions or feedback regarding the migration.

In the ServerManager, the list of web applications now also provides information on the servlet version used. This can be used to determine whether components are still installed on a server with Jakarta EE support that are to be migrated to the Jakarta EE API in the near future.

Servlet Version

When creating features, these are now no longer always saved in the project local storage, but only if this has been explicitly selected.

Note: When creating features using the FirstSpirit API, the project local storage is automatically used.

FirstSpirit 2023.10 supports the following module versions for FirstSpirit Content Experience Tools.

With the current FirstSpirit release it is now possible to optionally specify a minimum required FirstSpirit version during module development (module.xml).

The corresponding FirstSpirit version can be defined within the <module> block.

Example:

<module>
   <name>FirstSpirit Beispiel-Modul</name>
   <version>5.2</version>
   <min-fs-version>5.2.230909</min-fs-version>

   <components>
   ...
   </components>
<module>

This syntax can be used, for example, to ensure that a module can only be installed on a FirstSpirit server with version 5.2.230909 or newer.

The syntax is <FSMajorVersion>.<FSMinorVersion>.<FSBuildNumber>, where

• <FSMajorVersion>: 5
• <FSMinorVersion>: 2
• <FSBuildNumber>: 6-digit number consisting of two digits each for <year>, <version in year>, <build number>

The interface WebServer (FirstSpirit Developer API, package de.espirit.firstspirit.module) was extended by a new method getWebAppDir(String targetPath), which returns the path to a specific web application directory of this web server. Since the method has a default implementation, no modification is necessary for most derivations of the class.

In addition, the error that led to the results of generation jobs not being visible for the embedded Tomcat provided with FirstSpirit 2023.9 was fixed.