Overview

  • The bundled AdoptOpenJDK 11 was updated to Eclipse Temurin 17.0.3.
  • Two factor authentication supported.
  • Prevent side load of plugins for wrong application version.
  • It is now supported to use Web-Push notifications.
  • MeetUp has grown up, is called i-net CoWork and is now also available as a separate product.

Migration Information

  • Backups
    • Backups for MeetUp that were previously configured and used in maintenance are no longer compatible. CoWork must be activated again in the configured backup. It is recommended to create fresh backups before and after each update.

Security

  • Security Update for CVE-2021-37136
    • The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack.
  • Security Update for CVE-2021-37137
    • The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
  • Security Update for CVE-2020-21913
    • International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
  • Security Update for CVE-2021-4126
    • No information available.
  • Security Update for CVE-2021-43797
    • Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
  • Security Update for CVE-2021-41182
    • jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
  • Security Update for CVE-2021-41183
    • jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
  • Security Update for CVE-2021-41184
    • jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
  • Security Update for CVE-2020-36518
    • jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Plugins

Two-Factor Authentication

  • Plugin added to support two factor authentication.

Collaboration

  • Added a new command "serverstatus" which displays server information such as version, CPU load, memory usage, and more.

Discord

  • Fixed possible error message "accountID must not be null" in Discord configuration.

Maintenance

  • The User Accounts section of Maintenance now allows you to set user data for multiple users at the same time. This can be helpful for when entire departments or groups of users have changed addresses or other information.

Notifications

  • Web-Push notifications are supported now. A hint is displayed when the browser requests permission to show the notifications.

Store

  • Allow navigating through screenshots with the cursor keys. escape key will close the preview.

Push Notifications

  • Fixed encoding problems in notifications containing non-ASCII characters.

Repository

  • Report files with special characters in its name now opens in the repository.

Setup Wizard

  • Setup now works properly when updating single or more plugins via the plugin store. Duplicate executions and confusing messages will be avoided.
  • When updating the product-core plugin, Setup now updates all updateable plugins from the store.

Task Planner

  • Placeholders are now grouped if they start with the same prefix
  • Added the option 'custom' in time triggers.
  • A maintenance module is now provided for batch moving Task Planner tasks from one user to another.
  • Fixed visibility of Task Planner triggers, jobs, and actions (based on a user's permissions) to be in sync with the visibility of help sections for these triggers, jobs, and actions.

HTTP

  • Added option to add header entries to HTTP action

Users and Groups

  • Added apply button to the edit dialog of a user or group. This allows to save the changes without closing the edit dialog.
  • The avatar of users can now be changed in the users and groups application with a click on the avatar image of the selected user

Web Server

  • An optional web context of the web server can now be set if the server should not run in the root context.

Reporting

  • Font replacement improved for 'HTML advanced' formatted text. The replacement now works on character-level, just like in other text types.
  • TotalPageCount should now be evaluable in a trigger function.