Java Spring Framework Vulnerability Update for Jaspersoft Products

Hotfixes are available for the following products and versions. Please note that these hotfixes are only available to TIBCO customers and users with Support Portal access.

• JRS 8.0.1: https://support.tibco.com/s/hotfixes?id=a014z00000yUJmhAAG (compatible with any previous build of JRS 8.0.0 and 8.0.1) (download)
• JRS 7.9.2: https://support.tibco.com/s/hotfixes?id=a014z00000zSzGGAA0 (compatible with any previous build of JRS 7.9.0, 7.9.1 or 7.9.2) (download)
• JRS 7.8.1: https://support.tibco.com/s/hotfixes?id=a014z00000yU9caAAC (download)
• JRS 7.5.2: https://support.tibco.com/s/hotfixes?id=a014z00000yU9cVAAS (download)
• JSS 8.0.1: https://support.tibco.com/s/hotfixes?id=a014z00000zSzFIAA0
• JSS 7.9.0: https://support.tibco.com/s/hotfixes?id=a014z00000yTuU3AAK
• JRIO Pro 2.0.0: https://support.tibco.com/s/hotfixes?id=a014z00000yUBW6AAO
• JRIO At-Scale 2.0.0: https://support.tibco.com/s/hotfixes?id=a014z00000yUBWBAA4

AWS Fix for JasperReports Server

Note: This fix is applicable only if you installed JasperReports Server on AWS using the CloudFormation template; for other installation types, use the available cumulative hotfix and execute standard installation steps mentioned in the Readme.

1. Download and upload the Spring_aws_fix.sh to the Amazon S3 JasperReports customization bucket under the webapps/jasperserver-pro/WEB-INF folder, create such directory structure if not yet created.

Note: The S3 bucket referred to here is generated when you generate the stack/instance. The S3 bucket name is available in the Cloud Formation Stack output tab. You can search the S3 buckets by date, to see when the latest S3 buckets were generated.

2. Download the cumulative_hotfix.zip, unzip it and extract WEB-INF/lib from jasperserver-pro.zip. Upload all the new Spring jars to the same Amazon S3 JasperReports customization bucket under webapps/jasperserver-pro/WEB-INF/lib (create lib folder if not yet created).

3. Update the CloudFormation Template (CFT) with the following changes under the AWS::CloudFormation::Init section of LaunchConfig after the pullCustomizations config:

"springJarsFix": {
    "cwd"     : "/var/lib/tomcat/webapps/jasperserver-pro/WEB-INF/",
    "command" : { "Fn::Join" : [" ", 
            ["sudo systemctl stop tomcat && chmod +x Spring_aws_fix.sh && ./Spring_aws_fix.sh && systemctl start tomcat "]
          ]
        },
    "ignoreErrors" : "true"
    },

4. Also, under the Restart section, add the springJarsFix after 4-pullCustomizations to the commands list. For example:

commands" : ["4-pullCustomizations","springJarsFix","5-WriteInitializationMarker"...]

5. Update the CloudFormation stack by uploading the modified CloudFormation template, then wait until the CloudFormation Update completes.

6. Reboot all running instances.

After performing above steps, the old Spring jars will be replaced by new ones (from the hotfix) under /var/lib/tomcat/webapps/jasperserver-pro/WEB-INF.

Azure Fix for JasperReports Server

If you installed JasperReports Server on Azure, use the available cumulative hotfix and execute standard installation steps mentioned in the Readme.

References

• For more information, see the TIBCO Spring Security Daily Update.
• CVE-2022-22965
• VMWare Tanzu Vulnerability Report: https://tanzu.vmware.com/security/cve-2022-22965
• Spring Blog: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
• Talend Security Advisories: https://www.talend.com/security/incident-response/#spring4shell

Document History

• Version 1.0 (April 1, 2022): Initial vulnerability report published.
• Version 1.1 (April 1, 2022): Added Talend Security Advisories reference link.
• Version 2.0 (April 3, 2022): Removed JasperReports Library Pro/Community Edition from affected Jaspersoft products list.
• Version 3.0 (April 5, 2022): Added Mitigation section.
• Version 4.0 (April 6, 2022): Added Available Hotfixes section and hotfixes for JRS 8.0.1, JRS 7.9.2.
• Version 5.0 (April 6, 2022): Updated Available Hotfixes section (added JSS 7.9.0, JSS 8.0.1, JRIO Pro 2.0.0).
• Version 6.0 (April 7, 2022): Added AWS Fix for JasperReports Server section, and downloadable .sh zip file.
• Version 6.1 (April 8, 2022): Removed instructions for manually updating drivers (not needed).
• Version 7.0 (April 8, 2022): Added Azure Fix for JasperReports Server section; added JRIO At-Scale 2.0.0 Hotfix link; updated Talend Spring Security Advisory link.
• Version 7.1 (April 11, 2022): Added compatibility notes for hotfixes.
• Version 8.0 (April 20, 2022): Updated Available Hotfixes section (JRS 7.8.1, JRS 7.5.2)
• Version 8.1 (April 20, 2022): Removed Mitigation section.
• Version 9.0 (May 12, 2022): Added recommendation for JSS 7.5.x and 7.8.x users to upgrade to the latest version of Jaspersoft Studio (which is backwards compatible) to address vulnerability.
• Version 9.1 (May 18, 2022): Added downloadable Hotfix zip files for JRS 8.0.1, JRS 7.9.2, JRS 7.8.1, JRS 7.5.2.