R2022-05-RT (cumulative patch) - 8.0

This release differs from the previously released monthly patches. It contains a complete updated Talend ESB Runtime 8.0.1. Do not install it over an existing Talend ESB runtime.

Please refer to the installation instructions to install this patch as a new runtime.

This release includes the previous generally available patches from Talend ESB Runtime 8.0.1.

NOTE: To download this release, liaise with your Support contact at Talend.

This release contains the following fixes, in addition to the previous issues fixed in 8.0.1 patches:

• TPRUN-3354: Investigate message logging in case it is logging the authorization header
• TPRUN-3474: [8.0.1] Update of jackson-databind in TESB (CVE-2020-36518)
• TPRUN-3441: [8.0.1] Ensure no vulnerable Spring versions are introduced through Karaf feature dependencies
• TPRUN-3349: Security update of pax-url to 2.6.11
• TPRUN-3345: tRestClient - oauth2 - noClassDefFoundError Exception - Data Service
• TPRUN-2805: Disable Zookeeper AdminServer by default
• TPRUN-3065: Feature camel-spring-redis
• TPRUN-3157: CVE-related update of xstream to 1.4.19
• TPRUN-3214: Update pax logging to 1.11.15 in Talend ESB runtime
• TPRUN-2601: Make password encryption algorithm configurable + stronger
• TPRUN-2631: Update AlgorithmSuite in etc/org.talend.esb.job.saml.policy
• TPRUN-2175: data-source of mysql support only mysql 5
• TPRUN-2925: Error with zookeeper when deploy REST/Soap service with Service Locator
• TPRUN-3051: Update ant version used with Talend ESB
• TPRUN-2228: Update Jetty to 9.4.43 or later
• TPRUN-2915: Authorization fail for DemoService and DemoConsumerjob with error "No certificates for user"
• TPRUN-2553: Connecting to two SAP instances from same ESB container with datasource
• TPRUN-2841: [8.0.1] CVE-related update of Apache security in Talend ESB
• TPRUN-2840: [8.0.1] CVE-related update of pax-logging in Talend ESB runtime to 1.11.13.
• TPRUN-2793: [8.0] Missing feature repositories when offline
• TPRUN-2385: Component must have a valid id when adding cxf:bus element in route's spring tab
• TPRUN-2849: Runtime Error Installing Patch TPS-5064_v1-RT-8.0.1 error 'setenv.bat does not exist'
• TPRUN-2699: [CVE] Update of log4j2 and pax-logging because of GHSA-xxfh-x98p-j8fr
• TPRUN-2546: Setup patch creator for maintenance/8.0

• TPS-5111 [8.0.1] JMX port 8888 is inactive for runtime from TAC while enabling SSL (TPRUN-2948)
• TPS-5039 Mitigate / fix JobServer log4j2 vulnerabilities ( CVE-2021-44228 ) (TPRUN-2701)
• TPRUN-2543 Fix compatibility statement logged at JobServer startup
• TPS-5076 [8.0.1]including the possibility to define the certificate password when defining the SSL on jobserver and runtime (TPRUN-1805)

• TDM-9405: ConcurrentModificationException - on job data as service in runtime ESB
• TDM-9380: Remove DirectoryExecMapRuntimeImpl
• TDM-9298: Remove Importer for java classes and JAR files
• TDM-9290: Position reported by JSON Importer on errors is sometimes offset by 1
• TDM-9289: Remove ExecutionProperties from the ExecutionStatus
• TDM-9278: [OldRuntime]Execution status is accumulated when there are multiple executions for a tHMap
• TDM-9254: JSON default alternative matcher should accept integer as exact match for Double/Float
• TDM-9237: JSON Reader encodes ellipsis character
• TDM-9226: Null item in JSON array is omitted on output
• TDM-9222: JSON Reader gets stackoverflow with recursive Choice
• TDM-9215: Fix numeric enumeration in avro export/import completely
• TDM-9214: Default JSON Choice matcher should use Enum values when available
• TDM-9203: JSON default choice handler fails on optional array
• TDM-9201: Cobol Show Document error reporting must be improved
• TDM-9197: get error when install TDM feature to esb runtime
• TDM-9174: tuj job tdm_TDMT627_csv_writer is failed with JSON syntax error
• TDM-9078: Avro exporter fails to export expressions set on Choices
• TDM-9077: Avro exporter produces wrong operand avroloc within Choices and Alternatives
• TDM-9043: JSON Reader supporting expressions as discriminators
• TDM-9033: Add representation options to reduce size of JSON output
• TDM-8449: Support JSONL
• TDM-7427: data type optional segment is in test run result

• CVE-2020-36518: Update of Jackson to 2.13.2, Jackson-databind to 2.13.2.2 (TPRUN-3474)
• CVE-2022-22965: Update of Spring to 5.3.20 (TPRUN-3441)
• CVE-2021-43859: Update of XStream to 1.4.19, includes fixes for older XStream CVEs (TPRUN-3157)
• CVE-2021-44228: Update of Log4j to 2.17.1, pax-logging to 1.11.15 (TPRUN-3214, TPRUN-2701, TPRUN-2699)
• CVE-2021-36374: Update of Ant to 1.10.12, includes fixes for older Ant CVEs (TPRUN-3051)
• CVE-2021-34429: Update of Jetty to 9.4.43.v20210629, includes fixes for older Jetty CVEs (TPRUN-2228)
• CVE-2021-40690: Update of Apache xmlsec to 2.2.3, includes fixes for older xmlsec CVEs (TPRUN-2841)

Consider the following requirements for your system:

• This release contains a complete updated Talend ESB Runtime 8.0.1. Do not install it over an existing Talend ESB runtime..

• This runtime works with Java 8 or Java 11.

• Unzip the patch into an empty directory of your choice. You will get a complete new runtime.
• If you need to change any configurations in container/bin/setenv (resp. .../setenv.bat) or any of the configurations in container/etc/, edit the corresponding files.
• Start the container.
• Install any additional feature required as pre-condition for your routes and data services.
• If you are running behind a remote engine and TMC, you may be able to recover your tasks if you shut down and re-start the remote engine.
• Otherwise, you need to install your artifacts manually or re-install from TAC.

The configuration of the "talend-sapjco3-connector" in version 5.5.1 allows to define additional SAP endpoints adding prefixed properties. Here is a sample for an endpoint named "PEER_CONNECTION_POOL": ``` jco.client.ashost = myfirsthost.example.org jco.client.sysnr = 00 jco.client.client = 800 jco.client.user = DEVUSRA jco.client.passwd = * jco.client.lang = EN jco.destination.peak_limit = 10 jco.destination.pool_capacity = 3

endpoint.SAP_PEER_CONNECTION_POOL.jco.client.ashost = mysecondhost.example.org endpoint.SAP_PEER_CONNECTION_POOL.jco.client.sysnr = 00 endpoint.SAP_PEER_CONNECTION_POOL.jco.client.client = 100 endpoint.SAP_PEER_CONNECTION_POOL.jco.client.user = DEVUSRB endpoint.SAP_PEER_CONNECTION_POOL.jco.client.passwd = * endpoint.SAP_PEER_CONNECTION_POOL.jco.client.lang = EN endpoint.SAP_PEER_CONNECTION_POOL.jco.destination.peak_limit = 10 endpoint.SAP_PEER_CONNECTION_POOL.jco.destination.pool_capacity = 3

```

All features tesb-datasource-<database> have been updated to use updated default aliases ds-{database} instead of jdbc/sam.
If any Studio models are still using jdbc/sam aliases, update the related configuration file {container}/etc/org.talend.esb.datasource.{database}.cfg to add the property: datasource.jndi=ds-{database} List of all aliases are listed here: https://help.talend.com/r/tez87K9J65Ah64Rult_SAQ/K0Z7zYfpde~Qfq6zL7hzlQ

This feature doesn't impact manually deployed blueprints declaring data sources.

All AlgorithmSuites of policies with SAML, are updated from Basic128Sha256 to Basic256Sha256 for these features: - talend-job-controller - tesb-locator-soap-service - tesb-sam-service-soap

Configuration can be checked on these files, having value set to SAML:

If services are configured to use SAML: - you need to ensure external clients (executing out of container) use an updated policy when reaching these endpoints - you need to manually redeploy artifacts generated from Studio for models exposing/consuming endpoints using Service Locator or Service Activity Monitoring

Algorithm encryption for all ENC(xxx) passwords is upgraded by default to PBEWITHSHA256AND256BITAES-CBC-BC. All passwords declared as ENC(xxx) in configuration files or Talend Administration Center must be regenerated through these commands in Runtime console (please ensure environment variable TESB_ENV_PASSWORD is set): karaf@trun()> feature:install tesb-encryptor-command karaf@trun()> tesb:encrypt-text {textToEncrypt}

Algorithm can be configured by setting environment variable TESB_ENV_ALGORITHM.
If old ENC(xxx) values are still needed, update the algorithm to previous one by setting environment variable TESB_ENV_ALGORITHM to PBEWITHSHA256AND128BITAES-CBC-BC and restart Runtime.

Zookeeper AdminServer feature is now disabled by default, Service Locator feature is not impacted.
To reactivate this feature for embedded zookeeper in Runtime: - edit {container}/bin/setenv or {container}/bin/setenv.bat and change values -Dzookeeper.admin.enableServer=true Dzookeeper.admin.serverPort={AVAILABLE PORT} - restart Runtime

To reactivate this feature for standalone zookeeper provided with Talend-ESB: - edit Talend-ESB-V8.0.1/zookeeper/conf/zoo.cfg and add/change values zookeeper.admin.enableServer=true zookeeper.admin.serverPort={AVAILABLE PORT} - restart standalone zookeeper