Info required regarding Security+Advisory+WSO2-2021-1603 - wso2

For the advisory Security+Advisory+WSO2-2021-1603,
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603
the fix mentioned is to use the public fix at: https://github.com/wso2/carbon-kernel/pull/3145
The major change at the same is in login.jsp file in org.wso2.carbon.ui . As these changes are mentioned in compiled up carbon jar hence we cannot apply the change drectly. My question is if we can go ahead with using the following direct dependency:
<dependency>
<groupId>org.wso2.carbon</groupId>
<artifactId>org.wso2.carbon.ui</artifactId>
<version>4.6.3</version>
</dependency>
Would this resolve the issue or is there any other fix to be followed?
Has WSO2 released a patch version for wso2is v5.11 for the same?

I would suggest to checkount to v4.6.1 (which is the release tag for IS 5.11.0 in carbon-kernel) and build the org.wso2.carbon.ui component along with the fix. Then apply it as a patch [1].
Changing the dependency version to 4.6.3 could cause unexpected issues since there might be incompatibilities with other components.
https://docs.wso2.com/display/ADMIN44x/WSO2+Patch+Application+Process

Related

java.lang.NoClassDefFoundError with JModelica2.14

I am new to the Modelica world and installed JModelica2.14 on win10 via the binary file provided from the offical webpage. From the console I call setenv.bat, start the 64bit python envrionment and import '.\install\Python_64'. However, running the example files already throws an error. The minimal code example throwing the error is provided below. I assume that the binaries do not have a bug without anyone mentioning it. It would be great if someone could give a hint about what I am missing. Thanks a lot!
import modelicacasadi_wrapper
modelicacasadi_wrapper.OptimicaOptionsWrapper()
RuntimeError Traceback (most recent call last)
<ipython-input-11-ce2bcdfa3f06> in <module>()
----> 1 modelicacasadi_wrapper.OptimicaOptionsWrapper()
C:\JModelica.org-2.14\install\Python_64\modelicacasadi_wrapper\modelicacasadi_wrapper.pyc in __init__(self, *args)
3472 __init__(ModelicaCasADi::OptimicaOptionsWrapper self, OptimicaOptionsWrapper other) -> OptimicaOptionsWrapper
3473 """
-> 3474 this = _modelicacasadi_wrapper.new_OptimicaOptionsWrapper(*args)
3475 try:
3476 self.this.append(this)
RuntimeError: java.lang.NoClassDefFoundError org/jmodelica/optimica/compiler/ModelicaCompiler
Caused by: java.lang.ClassNotFoundException: org.jmodelica.optimica.compiler.ModelicaCompiler
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:583)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
This function is only given in binary format compiled from c++ code. therefore, I can not change the function without recompiling the library (I already tried). To me it seems like the org.jmodelica.optimica.compiler.ModelicaCompiler should have been a org.jmodelica.optimica.compiler.OptimicaCompiler. This would mean that I have to install the package from source and I haven't been sucessful with that yet.
I still use JModelica 2.14 in Python 2 and then have installed virtual environment with Conda to create a Python 3 environment where I then run the FMUs with the latest PyFMI package in Python 3.10 and Jupyter notebook. It all works very fine, but as Imke Kreuger indicated you have MSL 3.2.2 build 3 and there has been development in the Modelica Standard Library since then.
During installation you are asked whether you want "Graybox OPC Automation wrapper" and I usually say "NO" there. You may have said "YES" though, right? See Chapter 2.2.1 in the User guide.
The JModelica installation actually provide you with two different compilers.
One is for standard Modelica brings as output an FMU of CS or ME type. The other compiler is for Modelica extended with Optimica and does not bring any FMU and you are bound to work in Python 2.
Tried to reproduce your error (with my installation without the "Graybox OPC..."). If I (in the Python 2 environment) literally do the two commands, I get "Press any key to continue...." and when I press key the IPython window collapse.
However if you skip the two brackets at the end of the second command, then it is accepted!
If you write a question mark at the end you get information about what arguments you should have.
If you describe better what you want to do, we likely can help you better.
Note, it seems you want to use Optimica and that is an extension of Modelica that is only partially supported by OpenModelica, what I understand. The Optimica extension is well integrated in JModelica and originated in this context. For "ordinary" Modelica use I do not think you need to use this wrapper.

Failed startup of context o.e.j.w.WebAppContext error after upgrade jetty version to 9.4.44

Current jetty version is 9.4.6, I tried to upgrade 9.4.44, I got the error. Could you please help me?
WebAppContext:554 -Failed startup of context o.e.j.w.WebAppContext#163f1cd{passwd-change,/passwd-change,file:///run/opt/corp/gsec/7.0.0/java-service/gsec-jetty-base/temp/jetty-gsec-2443-passwd-change.war-_passwd-change-any-6326268666909012254.dir/webapp/,UNAVAILABLE}{/passwd-change.war}
Caused by: java.lang.IllegalAccessError: tried to access method org.eclipse.jetty.server.handler.ContextHandler$StaticContext.createInstance(Ljava/lang/Class;)Ljava/lang/Object; from class jetty.webapp.StandardDescriptorProcessor
at org.eclipse.jetty.webapp.StandardDescriptorProcessor.newListenerInstance(StandardDescriptorProcessor.java:1945) ~[apacheds-service-2.0.0-M24.jar:2.0.0-M24]
at org.eclipse.jetty.webapp.StandardDescriptorProcessor.visitListener(StandardDescriptorProcessor.java:1900) ~[apacheds-service-2.0.0-M24.jar:2.0.0-M24]
The jetty files in your apacheds-service-2.0.0-M24.jar needs to be upgraded as well.
List the contents of the apacheds-service-2.0.0-M24.jar file and you'll see classes in the org.eclipse.jetty. namespace.
Those are conflicting with your efforts to upgrade Jetty via the jetty-distribution zip.
I had a different setup that triggered a similar stacktrace: using cargo-maven2-plugin 16.1 in a spring 5 project, mvn cargo:run would fail because of a conflict with javafx.base-11.0.0-SNAPSHOT.jar files.
Upgrading to cargo-maven3-plugin 1.9.9 fixed the matter.
I'd encourage who ever uses cargo-maven2-plugin to migrate to cargo-maven3-plugin as the doc states:
Please be aware that the Maven 2 / Maven 3 plugin of Codehaus Cargo has been retired with our version 1.9.0 and has been superseded by a Maven 3 only plugin.

Jersey 2.25.1 HTTP STATUS 500 Error when using MediaType.APPLICATION_XML

Since 2 days I am stuck with this issue and it is not going away.
A simple explanation what I want to do:
1) build a simple Restful web service using jersey 2.25.1 which displays XML as the output.
2) Deploy it on Tomcat
Just for Info My JSON and plain text restful webservice is working fine. I am only getting errors for XML when using #RootElement. I am using java 1.8, Jersy 2.25.1, tomcat 8.5
I am getting the below error again and again and don't understand how to resolve it:
I have tried these two examples as well but no luck:
1) https://www.mkyong.com/webservices/jax-rs/download-xml-with-jersey-jaxb/
I have tried multiple examples but still, This error shows up and I cannot resolve it. Can some one please explain me why this is coming up.
Thanks in Advance.
Thank you everyone I fixed the issue... maybe this info will help everyone who is searching for the problem. The major problem was that I don't know for what reason If I make a new maven project on eclipse with Group Id org.glassfish.jersey.archetypes Artifact Id jersey-quickstart-webapp version 2.25.1, eclipse used to create a whole project with POM file as it suppose to and in this project if I even ran https://jersey.java.net/documentation/2.5.1/media.html#d0e7129
this simple jersey official demo, I was getting the same annotation error. I think in the POM file which eclipse create has a lot of things which I didn't needed and which must be overlapping with other things.
So in the above mkyong example I just added below dependency and it is now working just fine:
<dependency>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-runtime</artifactId>
<version>2.2.11</version>
</dependency>
Thanks everyone for helping me out. :)
Just a little update, even updating
I am also creating basic Jeresy webApp and faced same issue, but this above solution is not enough.
<dependency>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-runtime</artifactId>
<version>2.2.11</version>
</dependency>
After building and on hit our endpoint, one new issue will come
javax.servlet.ServletException: org.glassfish.jersey.server.ContainerException: java.lang.NoClassDefFoundError: com/sun/xml/bind/v2/model/annotation/AnnotationReader
To resolve this you need to add following dependencies too into pom.xml
<!-- https://mvnrepository.com/artifact/com.sun.xml.bind/jaxb-core -->
<dependency>
<groupId>com.sun.xml.bind</groupId>
<artifactId>jaxb-core</artifactId>
<version>2.3.0.1</version>
</dependency>
<!-- https://mvnrepository.com/artifact/com.sun.xml.bind/jaxb-impl -->
<dependency>
<groupId>com.sun.xml.bind</groupId>
<artifactId>jaxb-impl</artifactId>
<version>2.3.1</version>
</dependency>
So this is the complete solution, to make your Jeresy webApp work

java.lang.NoSuchMethodError: org.springframework.http.MediaType.getCharset()Ljava/nio/charset/Charset;

My junit fails with exception:
java.lang.NoSuchMethodError:
org.springframework.http.MediaType.getCharset()Ljava/nio/charset/Charset;
There are two more post with same issue but the solution provided dn't help me.
I have update my spring-core to 4.3.8.Release.
Exception occurs while executing the below code.
mockMvc.perform(post("/domains")
.contentType(MediaType.APPLICATION_JSON)
.content(requestJson)).andExpect(status().isOk());
It would be a great help if any one could share their ideas. Thank you !!
I fixed by adding:
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>4.3.8.RELEASE</version>
</dependency>
Make sure that you use the same version of spring-web and spring-core.
Issue was with spring jar conflicts. Issue resolved by matching all the spring jar's to the same version.

Xamarin linker error with AWSSDK

I have a Xamarin forms mobile project (Android and iOS).
When I try to install the AWSSDK.S3 to access Amazon services, I get the following linker error when trying to build iOS:
Failed to resolve "System.Void Amazon.Runtime.Internal.Util.AESEncryptionPutObjectStream::.ctor(System.IO.Stream,System.Byte[],System.Byte[])" reference from "AWSSDK.Core, Version=3.3.0.0, Culture=neutral, PublicKeyToken=885c28607f98e604"
..Android build has a similar error.
I have the following libraries installed:
AWSSDK.S3 v3.1.1.1
AWSSDK.Core v3.3.4
AWSSDK.SecurityToken v3.3.0.2
AWSSDK.CognitolIdenity v3.3.0.2
AWSSDK.CognitoIdentityProvider v3.3.1.2
PCLCrypto v2.0.147
PCLStorage v1.0.2
the only code in my project is:
var amazonClient = new AmazonS3Client();
Any ideas?
possible (bad) workaround that seems to work:
change in Linker Options/Linker behavior:
to: Don't link
instead of: Link SDK Assemblies only
The answer turns out to be found here:
Xamarin Forms IOS Failed to load assembly System.Net.Http.Primitive
even though its a different assembly error, the fix is the same:
update all the AWS.Core to the latest version: v3.3.6 in my case
install Microsoft.Bcl.Build v1.0.21
install Microsoft.Net.Http v2.2.29
Rolling back to AWSSDK.S3 V3.1.10 worked for me, done using the NuGet manager in Visual Studio. =)