R2022-04-RT (cumulative patch) - 8.0

Version
8.0
Language
English (United States)
Product
Talend ESB
Module
Talend ESB

R2022-04-RT (cumulative patch)

Info Value
Patch Name Patch_20220422_R2022-04_v1-RT-8.0.1
Release Date 2022-04-22
Target Version 20211109_1610-8.0.1
Product affected Talend ESB Runtime

Introduction

This patch is cumulative. It includes the previous generally available patches from Talend ESB Runtime 8.0.1.

NOTE: To download this patch, liaise with your Support contact at Talend.

Fixed issues

This patch contains the following fixes:

TESB

  • TPRUN-3474: [8.0.1] Update of jackson-databind in TESB (CVE-2020-36518)
  • TPRUN-3441: [8.0.1] Ensure no vulnerable Spring versions are introduced through Karaf feature dependencies
  • TPRUN-3349: Security update of pax-url to 2.6.11
  • TPRUN-3345: tRestClient - oauth2 - noClassDefFoundError Exception - Data Service
  • TPRUN-2805: Disable Zookeeper AdminServer by default
  • TPRUN-3065: Feature camel-spring-redis
  • TPRUN-3157: CVE-related update of xstream to 1.4.19
  • TPRUN-3214: Update pax logging to 1.11.15 in Talend ESB runtime
  • TPRUN-2601: Make password encryption algorithm configurable + stronger
  • TPRUN-2631: Update AlgorithmSuite in etc/org.talend.esb.job.saml.policy
  • TPRUN-2175: data-source of mysql support only mysql 5
  • TPRUN-2925: Error with zookeeper when deploy REST/Soap service with Service Locator
  • TPRUN-3051: Update ant version used with Talend ESB
  • TPRUN-2228: Update Jetty to 9.4.43 or later
  • TPRUN-2915: Authorization fail for DemoService and DemoConsumerjob with error "No certificates for user"
  • TPRUN-2553: Connecting to two SAP instances from same ESB container with datasource
  • TPRUN-2841: [8.0.1] CVE-related update of Apache security in Talend ESB
  • TPRUN-2840: [8.0.1] CVE-related update of pax-logging in Talend ESB runtime to 1.11.13.
  • TPRUN-2793: [8.0] Missing feature repositories when offline
  • TPRUN-2385: Component must have a valid id when adding cxf:bus element in route's spring tab
  • TPRUN-2849: Runtime Error Installing Patch TPS-5064_v1-RT-8.0.1 error 'setenv.bat does not exist'
  • TPRUN-2699: [CVE] Update of log4j2 and pax-logging because of GHSA-xxfh-x98p-j8fr
  • TPRUN-2546: Setup patch creator for maintenance/8.0

TPSVC

  • TPS-5111 [8.0.1] JMX port 8888 is inactive for runtime from TAC while enabling SSL (TPRUN-2948)
  • TPS-5039 Mitigate / fix JobServer log4j2 vulnerabilities ( CVE-2021-44228 ) (TPRUN-2701)
  • TPRUN-2543 Fix compatibility statement logged at JobServer startup
  • TPS-5076 [8.0.1]including the possibility to define the certificate password when defining the SSL on jobserver and runtime (TPRUN-1805)

TDM

  • TDM-9289: Remove ExecutionProperties from the ExecutionStatus
  • TDM-9278: [OldRuntime]Execution status is accumulated when there are multiple executions for a tHMap
  • TDM-9254: JSON default alternative matcher should accept integer as exact match for Double/Float
  • TDM-9237: JSON Reader encodes ellipsis character
  • TDM-9226: Null item in JSON array is omitted on output
  • TDM-9222: JSON Reader gets stackoverflow with recursive Choice
  • TDM-9215: Fix numeric enumeration in avro export/import completely
  • TDM-9214: Default JSON Choice matcher should use Enum values when available
  • TDM-9203: JSON default choice handler fails on optional array
  • TDM-9201: Cobol Show Document error reporting must be improved
  • TDM-9197: get error when install TDM feature to esb runtime
  • TDM-9174: tuj job tdm_TDMT627_csv_writer is failed with JSON syntax error
  • TDM-9078: Avro exporter fails to export expressions set on Choices
  • TDM-9077: Avro exporter produces wrong operand avroloc within Choices and Alternatives
  • TDM-9043: JSON Reader supporting expressions as discriminators
  • TDM-9033: Add representation options to reduce size of JSON output
  • TDM-8449: Support JSONL
  • TDM-7427: data type optional segment is in test run result

CVE fixes

  • CVE-2020-36518: Update of Jackson to 2.13.2, Jackson-databind to 2.13.2.2 (TPRUN-3474)
  • CVE-2022-22965: Update of Spring to 5.3.20 (TPRUN-3441)
  • CVE-2021-43859: Update of XStream to 1.4.19, includes fixes for older XStream CVEs (TPRUN-3157)
  • CVE-2021-44228: Update of Log4j to 2.17.1, pax-logging to 1.11.15 (TPRUN-3214, TPRUN-2701, TPRUN-2699)
  • CVE-2021-36374: Update of Ant to 1.10.12, includes fixes for older Ant CVEs (TPRUN-3051)
  • CVE-2021-34429: Update of Jetty to 9.4.43.v20210629, includes fixes for older Jetty CVEs (TPRUN-2228)
  • CVE-2021-40690: Update of Apache xmlsec to 2.2.3, includes fixes for older xmlsec CVEs (TPRUN-2841)

Prerequisites

Consider the following requirements for your system:

  • Talend ESB Runtime 8.0.1 must be installed.

  • Depending on the product, {container} is Talend-ESB-V8.0.1/container/ or Talend-Runtime-V8.0.1/

For all inserted properties: - if property already present (commented or uncommented), won't insert - if property not already present, will backup related file in dir {container}/patches/Patch_20220422_R2022-04_v1-RT-8.0.1/backup/ and insert property

For all updated properties: - if property commented or not already present, won't update - if property already present, will backup related file in dir {container}/patches/Patch_20220422_R2022-04_v1-RT-8.0.1/backup/ and update property

If any change required, update value after patch execution.

  • Patch will insert this property in {container}/etc/org.talend.remote.jobserver.server.cfg:
    # Set password of server side ssl key (command and file server) - optional
    #org.talend.remote.server.ssl.keyPassword=<jobserver_key_password>
    

Installation

Container

  • Start Runtime Container
  • Extract & replace the content of ZIP directory container into {container} directory

Structure after extract & replace should be :

{container}
├───bin     : existing dir
├───deploy  : existing dir
├───etc     : existing dir
├───...
├───patches : dir from current or previous patch
│   └───Patch_20220422_R2022-04_v1-RT-8.0.1
│           patch.bat
│           patch.commands
│           patch.sh
│           logs : directory for logs installation
├───system  : existing dir
│   ├───... : existing dir
├───...
  • Ensure username/password are right in {container}/patches/Patch_20220422_R2022-04_v1-RT-8.0.1/patch.bat or {container}/patches/Patch_20220422_R2022-04_v1-RT-8.0.1/patch.sh

    ... -u {username} -p {password} -f patch.commands ... 
    
  • Execute {container}/patches/Patch_20220422_R2022-04_v1-RT-8.0.1/patch.bat or {container}/patches/Patch_20220422_R2022-04_v1-RT-8.0.1/patch.sh

  • Ensure directory {container}/patches/Patch_20220422_R2022-04_v1-RT-8.0.1/logs contains new log files :
  • xxx-installation.log: patch installation log
  • xxx-init.log: state before patch installation
  • xxx-installed.log: state after patch installation
Please note that Routes using cMap (TDM feature) are not automatically restarted by the patch procedure.
You will need to restart the Runtime Container for changes to take effect.

Notes

Patch installation in "offline" mode

If you apply the Karaf patch in "offline" mode without connection to common Maven repositories, a small local Maven repository needs to be installed for the patch to succeed. The patch procedure will therefore check for the presence of a local Maven repository, eventually add one, and add the content required for the patch.

Bundle resolution errors

The updates are performed in three iterations. During the first and second iteration bundle resolution errors are showing up on the console and in the logs. This is expected, and these errors are resolved in the third iteration.

Enhancement of the SAP connector add-on

The configuration of the "talend-sapjco3-connector" in version 5.5.1 allows to define additional SAP endpoints adding prefixed properties. Here is a sample for an endpoint named "PEER_CONNECTION_POOL":

jco.client.ashost = myfirsthost.example.org
jco.client.sysnr = 00
jco.client.client = 800
jco.client.user = DEVUSRA
jco.client.passwd = ***
jco.client.lang = EN
jco.destination.peak_limit = 10
jco.destination.pool_capacity = 3

endpoint.SAP_PEER_CONNECTION_POOL.jco.client.ashost = mysecondhost.example.org
endpoint.SAP_PEER_CONNECTION_POOL.jco.client.sysnr = 00
endpoint.SAP_PEER_CONNECTION_POOL.jco.client.client = 100
endpoint.SAP_PEER_CONNECTION_POOL.jco.client.user = DEVUSRB
endpoint.SAP_PEER_CONNECTION_POOL.jco.client.passwd = ***
endpoint.SAP_PEER_CONNECTION_POOL.jco.client.lang = EN
endpoint.SAP_PEER_CONNECTION_POOL.jco.destination.peak_limit = 10
endpoint.SAP_PEER_CONNECTION_POOL.jco.destination.pool_capacity = 3

Datasources names updated default values (TPRUN-2175)

All features tesb-datasource-<database> have been updated to use updated default aliases ds-{database} instead of jdbc/sam.
If any Studio models are still using jdbc/sam aliases, update the related configuration file {container}/etc/org.talend.esb.datasource.{database}.cfg to add the property:

datasource.jndi=ds-{database}
https://help.talend.com/r/tez87K9J65Ah64Rult_SAQ/K0Z7zYfpde~Qfq6zL7hzlQ

This feature doesn't impact manually deployed blueprints declaring data sources.

Default AlgorithmSuite from Basic128Sha256 to Basic256Sha256 (TPRUN-2631)

All AlgorithmSuites of policies with SAML, are updated from Basic128Sha256 to Basic256Sha256 for these features: - talend-job-controller - tesb-locator-soap-service - tesb-sam-service-soap

Configuration can be checked on these files, having value set to SAML:

Configuration file Configuration key/value with SAML Impacted endpoint
etc/org.talend.esb.locator.service.cfg locator.authentication = SAML http://localhost:8040/services/ServiceLocatorService
etc/org.talend.esb.sam.service.soap.cfg sam.service.soap.authentication = SAML http://localhost:8040/services/MonitoringServiceSOAP

If services are configured to use SAML: - you need to ensure external clients (executing out of container) use an updated policy when reaching these endpoints - you need to manually redeploy artifacts generated from Studio for models exposing/consuming endpoints using Service Locator or Service Activity Monitoring

Default Algorithm for password encryption/decryption (TPRUN-2601)

Algorithm encryption for all ENC(xxx) passwords is upgraded by default to PBEWITHSHA256AND256BITAES-CBC-BC. All passwords declared as ENC(xxx) in configuration files or Talend Administration Center must be regenerated through these commands in Runtime console (please ensure environment variable TESB_ENV_PASSWORD is set):

karaf@trun()> feature:install tesb-encryptor-command
karaf@trun()> tesb:encrypt-text {textToEncrypt}

Algorithm can be configured by setting environment variable TESB_ENV_ALGORITHM.
If old ENC(xxx) values are still needed, update the algorithm to previous one by setting environment variable TESB_ENV_ALGORITHM to PBEWITHSHA256AND128BITAES-CBC-BC and restart Runtime.

Disable Zookeeper AdminServer by default (TPRUN-2805)

Zookeeper AdminServer feature is now disabled by default, Service Locator feature is not impacted.
To reactivate this feature for embedded zookeeper in Runtime: - edit {container}/bin/setenv or {container}/bin/setenv.bat and change values

-Dzookeeper.admin.enableServer=true Dzookeeper.admin.serverPort={AVAILABLE PORT}

To reactivate this feature for standalone zookeeper provided with Talend-ESB: - edit Talend-ESB-V8.0.1/zookeeper/conf/zoo.cfg and add/change values

zookeeper.admin.enableServer=true
zookeeper.admin.serverPort={AVAILABLE PORT}