@here https://dev.lucee.org/t/lucee-critical-security-alert-august-15th-2023-cve-2023-38693/12893

@zackster, I just tried to update my personal server from 5.3.8.206 to both 5.3.8.237 and 5.4.3.2 and neither build is working for me. I'm getting stack traces like:

"ERROR","http-bio-8080-exec-3","08/15/2023","13:13:49","","org.apache.felix.framework.BundleWiringImpl$BundleClassLoader.getBundle()Lorg/apache/felix/framework/BundleImpl;;lucee.runtime.exp.NativeException: org.apache.felix.framework.BundleWiringImpl$BundleClassLoader.getBundle()Lorg/apache/felix/framework/BundleImpl;
        at lucee.commons.io.log.log4j2.Log4j2Engine.getVersion(Log4j2Engine.java:635)
        at lucee.runtime.functions.system.GetApplicationSettings.call(GetApplicationSettings.java:217)
        at lucee.runtime.functions.system.GetApplicationSettings.call(GetApplicationSettings.java:77)
        at web_cfm$cf.call(/admin/web.cfm:21)
        at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1056)
        at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:948)
        at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:929)
        at server_cfm$cf.call(/admin/server.cfm:2)
        at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1056)
        at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:948)
        at lucee.runtime.listener.ModernAppListener._onRequest(ModernAppListener.java:219)
        at lucee.runtime.listener.ModernAppListener.onRequest(ModernAppListener.java:107)
        at lucee.runtime.PageContextImpl.execute(PageContextImpl.java:2493)
        at lucee.runtime.PageContextImpl._execute(PageContextImpl.java:2478)
        at lucee.runtime.PageContextImpl.executeCFML(PageContextImpl.java:2449)
        at lucee.runtime.engine.Request.exe(Request.java:45)
        at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1216)
        at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1162)
        at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:102)
        at lucee.loader.servlet.CFMLServlet.service(CFMLServlet.java:62)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:498)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
        at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:683)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:750)
Caused by: java.lang.NoSuchMethodError: org.apache.felix.framework.BundleWiringImpl$BundleClassLoader.getBundle()Lorg/apache/felix/framework/BundleImpl;

hmmm, log4j2...

Let me dig a little further

you could try stopping the server, replacing the fat jar under /lib, rather than just the .lco update approach?

Also, I'm seeing the following when going from 5.3.8.206 to 5.3.8.237:

"ERROR","http-bio-8080-exec-3","08/15/2023","13:29:28","","DOCTYPE is disallowed when the feature ""<http://apache.org/xml/features/disallow-doctype-decl>"" set to true.;DOCTYPE is disallowed when the feature ""<http://apache.org/xml/features/disallow-doctype-decl>"" set to true.;lucee.runtime.exp.NativeException: DOCTYPE is disallowed when the feature ""<http://apache.org/xml/features/disallow-doctype-decl>"" set to true.
        at lucee.runtime.text.xml.ThrowingErrorHandler.fatalError(ThrowingErrorHandler.java:44)
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.fatalError(ErrorHandlerWrapper.java:181)
        at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(XMLErrorReporter.java:399)
        at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(XMLErrorReporter.java:326)
        at com.sun.org.apache.xerces.internal.impl.XMLScanner.reportFatalError(XMLScanner.java:1466)
        at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$PrologDriver.next(XMLDocumentScannerImpl.java:913)
        at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:601)
        at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:112)
        at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:504)
        at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:841)
        at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:770)
        at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:141)
        at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:243)
        at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:338)

I would not expect to see a change of behavior here.

far jar being the full 80mb lucee jar

@zackster, should I kill the patches folder before I do that?

nope

ok

XXE mitigations are on my default now, since https://dev.lucee.org/t/lucee-5-4-2-and-6-0-now-has-anti-xxe-configuration-enabled-by-default/12811

@zackster, but I wouldn't expected that behavior in 5.3.8.237.

security releases are cumulative

@zackster a critical security patch being backported, should not have breaking changes. That's going to prevent some people from being able to update.

trust me I am fully aware of all the implications, sorry, that's just how it is

(Well, not with the XML error, but with it not generally working)

can you do me a favour and drop a comment on the post about that fat jar approach working?

I just did about the breaking changes.

thanks mate

@zackster Are there any details of the vulnerability so we know how critical it is to update? Or is it so critical (and no way that existing WAFs could be preventing it) that we should be dropping everything and patching?

alas no, advice is patch immediately

CommandBox

5.9.1

is now released, which bundles Lucee

5.4.3.2

as the bundled engine and default server.