Re: using cocoon 2.1 in the long-term, security concerns

Cédric Damioli <[email protected]> Mon, 19 Jul 2021 14:27:14 +0200
Newsgroups	gmane.text.xml.cocoon.user
Organization	Apache Software Foundation
Message-ID	<[email protected]>
--------------A173C357EA306B34B939E65D
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi,

Not only Tomcat, but each and every dependency your particular project uses.
As of today, Cocoon 2.1 works well in a Java 11+/Tomcat 9+ environment, 
with all dependencies upgraded.

Cocoon 2.1.13 itself contained a fix for a security-related issue, but 
in the past years, there wasn't many security issues targeting Cocoon core.

HTH,
Regards,
Cédric

Le 19/07/2021 à 14:05, warrell harries a écrit :
> The Tomcat version must be updated to address these concerns.
>
> That should do it
>
> On Mon, 19 Jul 2021, 13:03 Vincent Neyt, <[email protected] 
> <mailto:[email protected]>> wrote:
>
>     Hi Cocoon users,
>
>     I'd like to ask your opinion on the long-term security risks of
>     running Cocoon on a server. The colleague responsible for the
>     servers at my university is inquiring if the software I'm using
>     for my website is up to date and is concerned that I'm using
>     outdated software that could in the future pose a security risk.
>
>     I'm using cocoon 2.1.11, which I could probably upgrade to 2.1.13
>     without many problems. But I'm concerned about the long-term, and
>     wondering if it would perhaps be better to reprogram the website
>     I've been working on for 10 years into eXist DB (which would be a
>     huge time investment). I like cocoon very much and would love to
>     continue using it if it's possible.
>
>     I'm curious to hear your thoughts about using Cocoon 2.1 for the
>     long term: will it still work well inside future versions of
>     servlet containers like Tomcat? What about the java dependencies?
>     And will cocoon 2.1 continue to put out updates when security
>     risks are identified?
>
>     thanks very much,
>     Vincent
>

-- 
Cédric Damioli
CMS - Java - Open Source
www.ametys.org


--------------A173C357EA306B34B939E65D
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    Hi,<br>
    <br>
    Not only Tomcat, but each and every dependency your particular
    project uses.<br>
    As of today, Cocoon 2.1 works well in a Java 11+/Tomcat 9+
    environment, with all dependencies upgraded.<br>
    <br>
    Cocoon 2.1.13 itself contained a fix for a security-related issue,
    but in the past years, there wasn't many security issues targeting
    Cocoon core.<br>
    <br>
    HTH,<br>
    Regards,<br>
    Cédric<br>
    <br>
    <div class="moz-cite-prefix">Le 19/07/2021 à 14:05, warrell harries
      a écrit :<br>
    </div>
    <blockquote type="cite"
cite="mid:CAL-6e7sDRcmew6_1znprFYo31avQDh32tQsTb2rPLBeYeOMtfA@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="auto">The Tomcat version must be updated to address
        these concerns. 
        <div dir="auto"><br>
        </div>
        <div dir="auto">That should do it</div>
      </div>
      <br>
      <div class="gmail_quote">
        <div dir="ltr" class="gmail_attr">On Mon, 19 Jul 2021, 13:03
          Vincent Neyt, &lt;<a href="mailto:[email protected]"
            moz-do-not-send="true">[email protected]</a>&gt; wrote:<br>
        </div>
        <blockquote class="gmail_quote" style="margin:0 0 0
          .8ex;border-left:1px #ccc solid;padding-left:1ex">
          <div dir="ltr">Hi Cocoon users,
            <div><br>
            </div>
            <div>I'd like to ask your opinion on the long-term security
              risks of running Cocoon on a server. The colleague
              responsible for the servers at my university is inquiring
              if the software I'm using for my website is up to date and
              is concerned that I'm using outdated software that could
              in the future pose a security risk.<br>
              <div><br>
              </div>
              <div>I'm using cocoon 2.1.11, which I could probably
                upgrade to 2.1.13 without many problems. But I'm
                concerned about the long-term, and wondering if it would
                perhaps be better to reprogram the website I've been
                working on for 10 years into eXist DB (which would be a
                huge time investment). I like cocoon very much and would
                love to continue using it if it's possible.</div>
            </div>
            <div><br>
            </div>
            <div>I'm curious to hear your thoughts about using Cocoon
              2.1 for the long term: will it still work well inside
              future versions of servlet containers like Tomcat? What
              about the java dependencies? And will cocoon 2.1 continue
              to put out updates when security risks are identified?</div>
            <div><br>
            </div>
            <div>thanks very much,</div>
            <div>Vincent </div>
          </div>
        </blockquote>
      </div>
    </blockquote>
    <br>
    <pre class="moz-signature" cols="72">-- 
Cédric Damioli
CMS - Java - Open Source
<a class="moz-txt-link-abbreviated" href="http://www.ametys.org">www.ametys.org</a></pre>
  </body>
</html>

--------------A173C357EA306B34B939E65D--