Skip to main content
Tridion

Return to Question

dxa-1.8 is already a tag, it should not be forced into the title
Source Link
edit approved Mar 30, 2019 at 8:11
user1650
edit approved Mar 30, 2019 at 8:11
user1650

DXA 1.8 - Faster XML jackson-databind vulnerabilities

We have recently upgraded Java web app a from DXA 1.5 to 1.8, however we found that there are security issues with jackson-databind versions before 2.9.8.

With DXA 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in DD4T as below:

Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156)

Then we tried to upgrade the DD4T version, but that also failed with below exception:

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227) Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this . Really appreciate your help.

DXA 1.8 - Faster XML jackson-databind vulnerabilities

We have recently upgraded Java web app a from DXA 1.5 to 1.8, however we found that there are security issues with jackson-databind versions before 2.9.8.

With DXA 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in DD4T as below:

Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156)

Then we tried to upgrade the DD4T version, but that also failed with below exception:

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227) Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this . Really appreciate your help.

Faster XML jackson-databind vulnerabilities

We have recently upgraded Java web app a from DXA 1.5 to 1.8, however we found that there are security issues with jackson-databind versions before 2.9.8.

With DXA 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in DD4T as below:

Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156)

Then we tried to upgrade the DD4T version, but that also failed with below exception:

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227) Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this.

added 64 characters in body; edited tags; edited title
Source Link
Atila Sos
Atila Sos
  • 6.3k
  • 2
  • 16
  • 26

Dxa DXA 1.8 - FasterXMLFaster XML jackson-databind Vulnerabilitiesvulnerabilities

We have recently upgraded Java web app a from dxaDXA 1.5 to 1.8, however we found that there is aare security issues with jackson-databind versions before 2.9.8.

With dxaDXA 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in dd4tDD4T as below.

" Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156) "

Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156)

Then we tried to upgrade the dd4tDD4T version, but that also failed with below exception.

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227)

Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227) Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this . Really appreciate your help.

Dxa 1.8 - FasterXML jackson-databind Vulnerabilities

We have recently upgraded Java web app a from dxa 1.5 to 1.8, however we found that there is a security issues with jackson-databind versions before 2.9.8.

With dxa 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in dd4t as below.

" Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156) "

Then we tried to upgrade the dd4t version, but that also failed with below exception.

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227)

Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this . Really appreciate your help.

DXA 1.8 - Faster XML jackson-databind vulnerabilities

We have recently upgraded Java web app a from DXA 1.5 to 1.8, however we found that there are security issues with jackson-databind versions before 2.9.8.

With DXA 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in DD4T as below:

Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156)

Then we tried to upgrade the DD4T version, but that also failed with below exception:

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227) Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this . Really appreciate your help.

Source Link
user2869
user2869
  • 75
  • 6

Dxa 1.8 - FasterXML jackson-databind Vulnerabilities

We have recently upgraded Java web app a from dxa 1.5 to 1.8, however we found that there is a security issues with jackson-databind versions before 2.9.8.

With dxa 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in dd4t as below.

" Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156) "

Then we tried to upgrade the dd4t version, but that also failed with below exception.

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227)

Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this . Really appreciate your help.