SYMPTOM
Security Vulnerabilities were found in commons-collections-3.2.1 and commons-file upload-1.2.1 packages. These packages are from Intelligence Server's OpenRefine extension, used for Data Wrangling.
CAUSE
Currently, under ${InstallationPath}/IntelligenceServer/openrefine/webapp/WEB-INF/lib folder, we have bellow two packages which openRefine depends on, used for data wrangling in Strategy Web:
- commons-collections-3.2.1.jar
- commons-fileupload-1.2.1.jar
After a security scan was done, vulnerabilities were found in the two packages listed above.
ACTION
Please upgrade the version of these two packages, specifically commons-collections from 3.2.1 to 3.2.2 and commons-fileupload from 1.2.1 to 1.3.2. These 3rd party JAR can be download by below URL's:
https://mvnrepository.com/artifact/commons-collections/commons-collections/3.2.2
https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload/1.3.2
Follow the steps below to replace the packages:
1. Shutdown the I-Server
2. Delete the original old two jar files under ${InstallationPath}/IntelligenceServer/openrefine/webapp/WEB-INF/lib folder, or back up them in another folder
3. Put your newly downloaded two jar files under ${InstallationPath}/IntelligenceServer/openrefine/webapp/WEB-INF/lib folder
4. Restart the I-Server
Strategy has already replaced the files in Strategy version 11 by default so no changes are required.
KB442053
