TPRUN-8561 (cumulative patch)

Introduction

This patch is cumulative. It includes all previous generally available patches for Syncope and STS.

NOTE: For information on how to obtain this patch, reach out to your Support contact at Talend or download it from Talend Update.

Fixed issues

This patch contains the following fixes:

• TPRUN-8598 : [8.0.1] Patch spring-web, logback and spring-security-core CVE in Syncope and sts

Prerequisites

Consider the following requirements for your system:

• Syncope must be installed on a Tomcat server installation doc.

Installation

1. Stop Tomcat
2. Create a backup directory

   $ mkdir -p <backup_dir>
   

3. Copy original webapps directory to the backup directory

   $ cp -R apache-tomcat/webapps/sts* <backup_dir>
   $ cp -R apache-tomcat/webapps/syncope* <backup_dir>
   
   

   Note: if you made any changes in extracted service app before, don't forget to backup them too.
4. Remove original webapp directories and files

   $ rm -rf apache-tomcat/webapps/sts*
   $ rm -rf apache-tomcat/webapps/syncope*
   

5. Unzip the patch file:

   $ unzip Patch_20220407_TPS-5180_v1.zip
   

6. Copy patched war files to webapps directory

   $ cp sts.war apache-tomcat/webapps/
   $ cp syncope-console.war apache-tomcat/webapps/
   

   Unzip the following files in webapps/ syncope-console.war syncope-enduser.war

Copy from the backup the following files, and any other configuration files that have been modified syncope-enduser/WEB-INF/classes/enduser.properties syncope-console/WEB-INF/classes/console.properties

7. Start Tomcat

Uninstallation

To revert patch installation:

• stop Tomcat
• restore the backup files in webapps/ directory
• start Tomcat