Simion Legian (Bravura Solutions) asked a question.

March 15, 2022 at 10:55 PM
Upgrade jetty used by OE 11.7 to its latest patch version

Hi all,

 

Has anyone tried to upgrade the jetty server used in OE 11.7 to the latest patch version and if so can you share your experience with doing that?

 

The latest update of jetty was in OE 11.7.5, using jetty 9.4.14. This version has security vulnerabilities which are all resolved in subsequent patch versions. For instance jetty 9.4.45 is clean.

 

I did raise a call with support only to be told this is an enhancement. Apparently, other clients asked for the same and got the same response. The official line seems to be jetty is dead (as in no longer used in OE 12.x) so tough luck.

https://community.progress.com/s/article/What-version-of-Jetty-Webserver-does-OpenEdge-11-use-and-is-it-possible-to-upgrade-it

 

I did go ahead and raised an idea request https://openedge.ideas.aha.io/ideas/OPENEDGE-I-1017

 

Kindly asking all the affected customers and those among you who agree with the principle that security issues should be treated as maintenance issues rather than enhancement requests and Progress should address them in supported releases (OE 11.7 is after all officially supported till 2025 and I can still buy licenses for it) to vote for it.

 

Thanks,

Simi

  • 7 answers
  • 297 views
James Palmer, Stefan Drissen, and 2 others like this.

  • Mike Fechner (Consultingwerk)

    Log4j was patched in December and is also only used only in 11.7 and not in 12. So it can be done, when there is enough noise about it.

    • Simion Legian (Bravura Solutions)

      Thanks Mike, that's what I am trying to do, make some noise and hopefully drive home the need to actively scan for and address security vulnerabilities. New shiny features are great, but can't have a shaky foundation.

  • Mike Fechner (Consultingwerk)

    Looks like Progress does not intend to address this in a service pack for OpenEdge 11.7:

     

    https://openedge.ideas.aha.io/ideas/OPENEDGE-I-1017?utm_source=idea_comment_mailer&utm_medium=email&utm_campaign=subscribers

     

    "The possibility of upgrading Jetty in an Update would be very difficult and time-consuming to do the upgrade as well as potentially leaves the environment unstable. Our recommendation is to upgrade the OEM to 12.2 LTS release as this will solve the issue and we no longer use Jetty anymore, in that release onwards."

    • Simion Legian (Bravura Solutions)

      Thanks Mike, I am trying to get some clarifications on that idea as I find their reply a bit confusing. I am hoping update means 10.x or 11.x or even 9.x, not 9.4.x...

      • Rob Fitzpatrick (White Star Software)

        "Update" is the new terminology in place of service pack/hotfix. E.g. 11.7.12. and 11.7.13 are updates to the 11.7 release.

      • Simion Legian (Bravura Solutions)

        Oh, I misread the reply. I thought he meant jetty update, while he was clearly talking about an OE update. Bummer