Release Notes FirstSpirit™ 2023.11

Release Notes

FirstSpirit™ 2023.11

1 Administration

1.1 Update of internally used software

As of the release 2023.11, the following internally used software has been updated.

  • Eclipse Jetty (contained in the module fs-jetty.fsm / “FirstSpirit Jetty Service”)
    Update to version 12.0.1
    As before, use of Eclipse Jetty for production purposes is not recommended!
  • JxBrowser (Chrome browser engine for displaying the integrated preview in FirstSpirit SiteArchitect)
    Update to version 7.35.1 (Chromium 117.0.5938.62) --> Security update due to CVE-2023-4863

1.2 Critical security vulnerability: "Heap Buffer Overflow" in WebP - JxBrowser update

Due to CVE-2023-4863, the bundled JxBrowser has been updated to the version 7.35.1 (Chromium 117.0.5938.62). The JxBrowser is used for the integrated preview in the SiteArchitect.

A “heap buffer overflow” in WebP allowed a remote attacker to perform an out-of-bounds memory-write, and thus possibly inject malicious code. A manipulated WebP image can therefor lead to code injection.

FirstSpirit versions since 2019.11 are affected.

How can the vulnerability be exploited?

  • An editor adds a manipulated WebP image to a project.

What do you have to do?

  • (Server) Update to 5.2.230817 (Non-Jakarta) or 5.2.231106 (Jakarta)
  • (Client) Update the local browsers

Mitigation without FS Update

  • (Server) Prevent uploading of WebP (set appropriate restrictions in the project) or
  • (Server) Configure WebP as media type file
  • (Client) Disable the integrated preview in SA (JxBrowser)
  • (Client) Update the local browsers

2 External Synchronization / Content Transport

Content Transport: Feature Model Transport

The current release supports the transport of the feature model.

A feature model contains information about which FirstSpirit store nodes and entities belong to the content of the feature package. This information is stored in the feature.xml file, which is contained in the ZIP feature file.

The feature model can now also be installed in the target project.

  • per FirstSpirit API: Method installFeature from the interface FeatureInstallAgent
  • per “fs-cli” (FSDevTools from version 4.5.0): Command feature install with parameter --include-feature-model

It should be mentioned that the feature model can be installed exactly when all FirstSpirit store nodes from feature.xml can be found in the target project after the feature has been installed. If at least one object from feature.xml cannot be found, the feature model installation will fail with an exception.

The Content2 source has to be transported explicitly when transporting data sets.

3 FirstSpirit Content Experience Tools (CXT)

Latest module versions

FirstSpirit 2023.11 supports the following module versions for FirstSpirit Content Experience Tools.

Module / file nameVersion number
FirstSpirit CXT Plattform
platform-[version].fsm		5.0.2
FirstSpirit CXT DAP Bridge
dataservice-[version].fsm		1.44.15
FirstSpirit CXT FragmentCreator
fragment-creator-[version].fsm		5.0.1
FirstSpirit Fragment DAP
fragmentdap-[version].fsm		1.40.23
FirstSpirit Media DAP
mediadap-[version].fsm		1.31.14
FirstSpirit PageRef DAP
pageref-[version].fsm		1.9.14
FirstSpirit Markdown Editor
markdown-editor-[version].fsm		1.29.13
FirstSpirit Tagging Editor
tagging-editor-[version].fsm		1.29.13
FirstSpirit CXT FragmentCreator - CaaS Integration
caas-integration-[version].fsm		1.31.13

4 Module Development, Scripts, API

Switchover of the FirstSpirit byte code level from Java 11 to Java 17

The Java dependencies provided by Crownpeak, such as the fs-isolated-runtime.jar, now require at least Java 17 during the compile process.

Overview

ID Description Categories
CORE-5663

The time information for ongoing maintenance work is now output in the user's local time zone.

 Server Administrator
CORE-14898

The installation of the “FS INTEGRATION” web component from the “FirstSpirit Dynamic Database Access” module (fs-integration.fsm) in the ContentCreator led to an exception.

 ContentCreator, Modules, Server Administrator
CORE-14953

Switchover of the FirstSpirit byte code level from Java 11 to Java 17

Further information can be found in chapter “Module Development, Scripts, API: Switchover of the FirstSpirit byte code level from Java 11 to Java 17”.

 Java, Module development
CORE-15332

Checks on deployed web applications, for example in the ServerManager, now result in less logging in the FirstSpirit server log.

 Server Administrator
CORE-15376

When configuring archiving tasks, the option “Maintain version history completely (no archiving)” has been removed.

 ServerManager
CORE-15475

The current release supports the transport of the feature model.

Further information can be found in chapter “External Synchronization / Content Transport: Content Transport: Feature Model Transport”.

 Content Transport, FSDevTools, FirstSpirit API
CORE-15523

Fixed rare cases during site generation where the fallback language was not correctly chosen for FS_CATALOG components.

 Generation, Input Components
CORE-15589

A possible incorrect output of the user of a task in the audit logging has been fixed.

 Server Administrator
CORE-15594

Fixed an error in archiving that could cause the initial repository revision to be archived.

 Archiving, FirstSpirit Administrator
CORE-15626

Fixed a display problem in the schedule task edit dialog that could occur when adding or deleting actions.

 Server Administrator, ServerManager
CORE-15630

Improved behaviour when network transfer is blocked or interrupted.

 ContentCreator, ServerManager, SiteArchitect
CORE-15637

A problem with archiving was fixed that could lead to a large number of error messages in the archiving log (e.g. Ambiguous store type for id XY).

 Archiving
CORE-15654

Updating the FirstSpirit web applications fs5root (start page) in the ServerManager now no longer causes it to have to be closed during the process. Instead, the connection is automatically reconnected in most cases.

 Server Administrator, ServerManager
CORE-15672

Update of internally used software

Further information can be found in chapter “Administration: Update of internally used software”.

 Integrated software
CORE-15689

A vulnerability has been discovered in the WebP library libwebp (CVE-2023-4863). The vulnerability is classified as critical. Crownpeak therefore recommends a prompt update to a secured FirstSpirit version (current build of 2023.8 or 2023.11). Due to CVE-2023-4863, the JxBrowser used by FirstSpirit for the integrated preview in SiteArchitect has been updated to the version 7.35.1 (Chromium 117.0.5938.62).

Further information can be found in chapter “Administration: Critical security vulnerability: "Heap Buffer Overflow" in WebP - JxBrowser update”.

 Preview, Security, SiteArchitect
CORE-15700

FirstSpirit Content Experience Tools: Latest module versions

Further information can be found in chapter “FirstSpirit Content Experience Tools (CXT): Latest module versions”.

 FirstSpirit Content Experience Tools (CXT)
CXT-2999

The display and use of default and fallback values in the ContentCreator has been improved. However, the existing restrictions are still valid (see Template development / ContentCreator / Restrictions (→FirstSpirit Online Documentation)).

 ContentCreator
CXT-3009

Within forms there were display problems for the FS_BUTTON input component.

 ContentCreator
CXT-3027

In case of misconfiguration, it could happen that non-visible SEO URLs of the element were reset.

 ContentCreator

Deprecations

Functionality Deprecated as of Will be removed / Was removed as of
Input component CMS_INPUT_CONTENTAREALIST 5.2R3
Input component CMS_INPUT_CONTENTLIST 5.2R3
Input component CMS_INPUT_FILE 5.2R3
Input component CMS_INPUT_LINKLIST 5.2R3
Input component CMS_INPUT_OBJECTCHOOSER 5.2R3
Input component CMS_INPUT_PAGEREF 5.2R3
Input component CMS_INPUT_PICTURE 5.2R3
Input component CMS_INPUT_TABLIST 5.2R3
FirstSpirit Access API: de.espirit.firstspirit.agency.GroupsAgent 5.2R15
FirstSpirit Access API: delete (de.espirit.firstspirit.access.AccessUtil) 5.2R18
FirstSpirit Access API: release (de.espirit.firstspirit.access.AccessUtil) 2018-06
FirstSpirit Access API: getLastLoginAsDate (de.espirit.firstspirit.agency.UserStatisticsAgent) 2018-07
FirstSpirit Access API: remainingDurationOfCurrentStageInMillis (de.espirit.firstspirit.server.MaintenanceModeInfo) 2018-07 2025-13
FirstSpirit Access API: getStartingTimeOfStageAsDate (de.espirit.firstspirit.server.MaintenanceModeInfo) 2018-07 2025-13
FirstSpirit Access API: getSelectedWebserverConfiguration (de.espirit.firstspirit.access.serverConfiguration) 2018-10 2025-13
FirstSpirit Access API: setSelectedWebserverConfiguration (de.espirit.firstspirit.access.serverConfiguration) 2018-10 2025-13
FirstSpirit Access API: getSelectedWebServer (de.espirit.firstspirit.access.project.Project) 2018-10 2025-13
FirstSpirit Access API: setSelectedWebServer (de.espirit.firstspirit.access.project.Project) 2018-10 2025-13
FirstSpirit Access API: getLostAndFoundStoreNodes(); (de.espirit.firstspirit.feature.FeatureInstallResult) 2018-10
FirstSpirit Access API: getDeletedStoreNodes(); (de.espirit.firstspirit.feature.FeatureInstallResult) 2018-10
FirstSpirit Access API: de.espirit.firstspirit.access.store.Previewable 2019-01
WebSphere Application Server support for FirstSpirit 2019-05
Database layer for Oracle Database 11g/12c 2020-12 2025-05
FirstSpirit Access API: redirectTemplateLogToDefaultLog() (Interface RenderingAgent.Renderer) 2021-05
Support for Log4j 1 2022-05 2024-06