Third-Party Update: Spring-Security

Due to a security issue ( https://nvd.nist.gov/vuln/detail/CVE-2021-22119 ) we updated spring-security from 5.3.9.RELEASE to 5.3.10.RELEASE. We are not aware of any incompatibilities.

(CMS-19702)

Fixed CAE Feeder deadlock for JMX access

Fixed a bug in the CAE Feeder that could lead to a deadlock when reading attribute InvalidationQueueSize of MBean ContentDependencyInvalidator via JMX.

(CMS-19642)

Third-Party Update: Apache PDFBox

Apache PDFBox has been updated to version 2.0.24 to avoid a security vulnerability of the previous version (CVE-2021-31812).

(CMS-19638)

Fixed Output for cm encryptpasswordproperty

cm encryptpasswordproperty failed to output more details especially in case of failures while encrypting or decrypting passwords.

This has been fixed.

Upgrade:

Unless you defined a custom EncryptionService , no upgrade steps are required.

For custom implementations of EncryptionService it is strongly recommended to override the default method EncryptionService.usingLogger(logger:Logger):EncryptionService , so that tools such as cm encryptpasswordproperty benefit from log messages provided by your custom service. Ensure to read the implementation specification carefully.

As alternative, you may want to adjust the tools-logging-configuration, so that your custom service is able to log to stdout.

(CMS-19531)

The 'property' column of the 'System' table has now the length 100

When a string property of a document type is observed it is registered in the 'System' table. To handle long document type and property names the 'property' column of the table has now the length of 100 instead of 50.

(CMS-19293)

Mask password in MongoDB client URI with cluster connection

The password in a MongoDB client URI with cluster connection (mongodb+srv://...) is masked in log messages now, alike the password in a default MongoDB client URI (mongodb://...).

(CMS-19063)

Fixed Broken Order of Transformations

The list of image transformation variants is now returned sorted by name. This may lead to a different order of variants inside the Studio's Image Editor. To customize the order, change the struct list of variants in the settings document Responsive Image Settings .

(CMS-18680)

Encrypt Initial Passwords

The properties cap.server.initialPassword.* can be encrypted using the cm encryptpasswordproperty tool now.

(CMS-11312)