diff --git a/docs/.vuepress/components/ELSTechnology.vue b/docs/.vuepress/components/ELSTechnology.vue index 13a11862..5e760874 100644 --- a/docs/.vuepress/components/ELSTechnology.vue +++ b/docs/.vuepress/components/ELSTechnology.vue @@ -97,98 +97,122 @@ const techData = [ { name: "Dom4j", versions: "1.6.1", + link: "./java-libraries/", }, { name: "SnakeYAML", versions: "1.23 | 1.26 | 1.29 | 1.30 | 1.33", + link: "./java-libraries/", }, { name: "Google Guava", versions: "20.0 | 30.1-jre | 31.1-jre", + link: "./java-libraries/", }, { name: "Apache Hadoop", - versions: "2.7.3, 2.7.1", + versions: "2.7.1, 2.7.3", + link: "./apache-hadoop/", }, { name: "Apache Struts", versions: "1.3.5 | 2.5.33", + link: "./apache-struts/", }, { name: "Apache Spark", versions: "2.4.8", + link: "./apache-spark/", }, { name: "Okio", versions: "2.8.0", + link: "./java-libraries/", }, { name: "Apache Commons BeanUtils", versions: "1.9.4", + link: "./java-libraries/", }, { name: "Apache Commons HttpClient", versions: "3.1", + link: "./java-librariest/", }, { name: "Apache CXF", versions: "3.5.9", + link: "./java-libraries/", }, { name: "DNSJava", versions: "2.1.7", + link: "./java-libraries/", }, { name: "el-spec", versions: "3.0.0", + link: "./java-libraries/", }, { name: "Apache Hive", versions: "2.3.9", + link: "./java-libraries/", }, { name: "Apache Kafka", versions: "3.2.3", + link: "./apache-kafka/", }, { name: "Jackson", versions: "1.9.13", + link: "./jackson/", }, { name: "Logback", versions: "1.2.13", + link: "./java-libraries/", }, { name: "Netty", versions: "4.1.115.Final | 4.1.63.Final", + link: "./java-libraries/", }, { name: "Nimbus JOSE + JWT", versions: "9.22 | 9.24.4", + link: "./java-libraries/", }, { name: "Querydsl", versions: "5.1.0", + link: "./java-libraries/", }, { name: "Plexus Utils", versions: "1.5.8", + link: "./java-libraries/", }, { name: "PostgreSQL", - versions: "42.5.0 | 42.2.16", + versions: "42.2.16 | 42.5.0", + link: "./postgresql/", }, { name: "Protobuf", versions: "2.5.0" + ,link: "./protobuf/", }, { name: "Reload4j", versions: "1.2.17", + link: "./java-libraries/", }, { name: "Snappy Java", versions: "1.1.8.4", + link: "./java-libraries/", }, { name: "Apache Tomcat", @@ -197,34 +221,42 @@ const techData = [ { name: "Apache Thrift", versions: "0.9.3", + link: "./java-libraries/", }, { name: "Thymeleaf", versions: "3.0.15.RELEASE", + link: "./java-libraries/", }, { name: "Apache Velocity Engine", versions: "1.7", + link: "./java-libraries/", }, { name: "Woodstox", versions: "5.0.3", + link: "./java-libraries/", }, { name: "XMLUnit", versions: "2.9.1 | 2.9.0" - }, - { - name: "Apache Santuario XML Security For Java", - versions: "2.0.10 | 2.3.1", + ,link: "./java-libraries/", }, { name: "Apache Commons IO", versions: "2.7", + link: "./java-libraries/", }, { name: "Apache Commons Lang", versions: "2.4 | 2.6 | 3.4 | 3.10 | 3.12.0", + link: "./apache-commons-lang/", + }, + { + name: "Apache Santuario XML Security For Java", + versions: "2.0.10 | 2.3.1", + link: "./java-libraries/", }, ], }, diff --git a/docs/.vuepress/config-client/sidebar.ts b/docs/.vuepress/config-client/sidebar.ts index e993026f..7a52569b 100644 --- a/docs/.vuepress/config-client/sidebar.ts +++ b/docs/.vuepress/config-client/sidebar.ts @@ -63,6 +63,42 @@ export default { path: '/els-for-runtimes-and-libraries/openjdk/', icon: '/images/openjdk-logo.png', }, + { + path: '/els-for-runtimes-and-libraries/apache-hadoop/', + icon: '/images/apache.webp', + }, + { + path: '/els-for-runtimes-and-libraries/apache-struts/', + icon: '/images/apache.webp', + }, + { + path: '/els-for-runtimes-and-libraries/apache-spark/', + icon: '/images/apache-spark.webp', + }, + { + path: '/els-for-runtimes-and-libraries/apache-kafka/', + icon: '/images/apache-kafka.webp', + }, + { + path: '/els-for-runtimes-and-libraries/postgresql/', + icon: '/images/postgresql.webp', + }, + { + path: '/els-for-runtimes-and-libraries/protobuf/', + icon: '/images/java.png', + }, + { + path: '/els-for-runtimes-and-libraries/jackson/', + icon: '/images/jackson.webp', + }, + { + path: '/els-for-runtimes-and-libraries/apache-commons-lang/', + icon: '/images/apache.webp', + }, + { + path: '/els-for-runtimes-and-libraries/java-libraries/', + icon: '/images/java.png', + }, { title: 'Python', type: 'section-header', diff --git a/docs/.vuepress/public/images/apache-hadoop.webp b/docs/.vuepress/public/images/apache-hadoop.webp new file mode 100644 index 00000000..b6c3ca38 Binary files /dev/null and b/docs/.vuepress/public/images/apache-hadoop.webp differ diff --git a/docs/.vuepress/public/images/apache-kafka.webp b/docs/.vuepress/public/images/apache-kafka.webp new file mode 100644 index 00000000..9820100f Binary files /dev/null and b/docs/.vuepress/public/images/apache-kafka.webp differ diff --git a/docs/.vuepress/public/images/apache-spark.webp b/docs/.vuepress/public/images/apache-spark.webp new file mode 100644 index 00000000..11887773 Binary files /dev/null and b/docs/.vuepress/public/images/apache-spark.webp differ diff --git a/docs/.vuepress/public/images/apache-struts.webp b/docs/.vuepress/public/images/apache-struts.webp new file mode 100644 index 00000000..e6c5f637 Binary files /dev/null and b/docs/.vuepress/public/images/apache-struts.webp differ diff --git a/docs/.vuepress/public/images/apache.webp b/docs/.vuepress/public/images/apache.webp new file mode 100644 index 00000000..49394c77 Binary files /dev/null and b/docs/.vuepress/public/images/apache.webp differ diff --git a/docs/.vuepress/public/images/jackson.webp b/docs/.vuepress/public/images/jackson.webp new file mode 100644 index 00000000..56bd5308 Binary files /dev/null and b/docs/.vuepress/public/images/jackson.webp differ diff --git a/docs/.vuepress/public/images/postgresql.webp b/docs/.vuepress/public/images/postgresql.webp new file mode 100644 index 00000000..11f7209f Binary files /dev/null and b/docs/.vuepress/public/images/postgresql.webp differ diff --git a/docs/els-for-runtimes-and-libraries/apache-commons-lang/README.md b/docs/els-for-runtimes-and-libraries/apache-commons-lang/README.md new file mode 100644 index 00000000..be058faf --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/apache-commons-lang/README.md @@ -0,0 +1,160 @@ +# Apache Commons Lang + +TuxCare's Endless Lifecycle Support (ELS) for Apache Commons Lang provides security patches, and selected bug fixes, that are integral to the stable operation of applications using Commons Lang. + +## Supported Versions + +* Apache Commons Lang 2.4, 2.6, 3.4, 3.10, 3.12.0 + +## Connection to ELS for Apache Commons Lang Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Apache Commons Lang repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Apache Commons Lang repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + + Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Apache Commons Lang repository and plugins to your build configuration: + + + +* To fully switch from the official Apache Commons Lang repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the Apache Commons Lang dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Apache Commons Lang repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Commons Lang repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Apache Commons Lang repository into your project. You can now benefit from the secure and vetted Apache Commons Lang libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for Apache Commons Lang ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/commons-lang/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/commons-lang/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + diff --git a/docs/els-for-runtimes-and-libraries/apache-hadoop/README.md b/docs/els-for-runtimes-and-libraries/apache-hadoop/README.md new file mode 100644 index 00000000..fbe45e1d --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/apache-hadoop/README.md @@ -0,0 +1,167 @@ +# Apache Hadoop + +TuxCare's Endless Lifecycle Support (ELS) for Apache Hadoop provides security patches, and selected bug fixes, that are integral to the stable operation of applications running on these versions of Apache Hadoop core components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). +Our ELS for Apache Hadoop service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Hadoop applications. + +## Supported Versions + +* Apache Hadoop 2.7.1, 2.7.3 + +## Connection to ELS for Apache Hadoop Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Apache Hadoop repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Apache Hadoop repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + +Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Apache Hadoop repository and plugins to your build configuration: + + + +* To fully switch from the official Apache Hadoop repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the Apache Hadoop dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Apache Hadoop repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Hadoop repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Apache Hadoop repository into your project. You can now benefit from the secure and vetted Apache Hadoop libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for Apache Hadoop ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.hadoop/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.hadoop/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + + + + + diff --git a/docs/els-for-runtimes-and-libraries/apache-kafka/README.md b/docs/els-for-runtimes-and-libraries/apache-kafka/README.md new file mode 100644 index 00000000..2f433ec7 --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/apache-kafka/README.md @@ -0,0 +1,160 @@ +# Apache Kafka + +TuxCare's Endless Lifecycle Support (ELS) for Apache Kafka provides security patches, and selected bug fixes, that are integral to the stable operation of applications running on Apache Kafka. + +## Supported Versions + +* Apache Kafka 3.2.3 + +## Connection to ELS for Apache Kafka Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Apache Kafka repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Apache Kafka repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + + Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Apache Kafka repository and plugins to your build configuration: + + + +* To fully switch from the official Apache Kafka repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the Apache Kafka dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Apache Kafka repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Kafka repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Apache Kafka repository into your project. You can now benefit from the secure and vetted Apache Kafka libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for Apache Kafka ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.kafka/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.kafka/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + diff --git a/docs/els-for-runtimes-and-libraries/apache-spark/README.md b/docs/els-for-runtimes-and-libraries/apache-spark/README.md new file mode 100644 index 00000000..acd56c33 --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/apache-spark/README.md @@ -0,0 +1,161 @@ +# Apache Spark + +TuxCare's Endless Lifecycle Support (ELS) for Apache Spark provides security patches, and selected bug fixes, that are integral to the stable operation of applications running on these versions of Apache Spark core components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). +Our ELS for Apache Spark service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Spark applications. + +## Supported Versions + +* Apache Spark 2.4.8 + +## Connection to ELS for Apache Spark Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Apache Spark repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Apache Spark repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + +Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Apache Spark repository and plugins to your build configuration: + + + +* To fully switch from the official Apache Spark repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the Apache Spark dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Apache Spark repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Spark repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Apache Spark repository into your project. You can now benefit from the secure and vetted Apache Spark libraries it provides. + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + + + + + diff --git a/docs/els-for-runtimes-and-libraries/apache-struts/README.md b/docs/els-for-runtimes-and-libraries/apache-struts/README.md new file mode 100644 index 00000000..9079d52c --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/apache-struts/README.md @@ -0,0 +1,167 @@ +# Apache Struts + +TuxCare's Endless Lifecycle Support (ELS) for Apache Struts provides security patches, and selected bug fixes, that are integral to the stable operation of applications running on these versions of Apache Struts core components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). +Our ELS for Apache Struts service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Struts applications. + +## Supported Versions + +* Apache Struts 1.3.5, 2.5.33 + +## Connection to ELS for Apache Struts Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Apache Struts repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Apache Struts repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + +Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Apache Struts repository and plugins to your build configuration: + + + +* To fully switch from the official Apache Struts repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the Apache Struts dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Apache Struts repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Struts repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Apache Struts repository into your project. You can now benefit from the secure and vetted Apache Struts libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for Apache Struts ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.struts/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.struts/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + + + + + diff --git a/docs/els-for-runtimes-and-libraries/jackson/README.md b/docs/els-for-runtimes-and-libraries/jackson/README.md new file mode 100644 index 00000000..83106edc --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/jackson/README.md @@ -0,0 +1,160 @@ +# Jackson + +TuxCare's Endless Lifecycle Support (ELS) for Jackson provides security patches, and selected bug fixes, that are integral to the stable operation of applications running on Jackson. + +## Supported Versions + +* Jackson 1.9.13 + +## Connection to ELS for Jackson Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Jackson repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your Maven and Gradle projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Jackson repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + + Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Jackson repository and plugins to your build configuration: + + + +* To fully switch from the official Jackson repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the Jackson dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Jackson repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Jackson repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Jackson repository into your project. You can now benefit from the secure and vetted Jackson libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for Jackson ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/org.codehaus.jackson/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.codehaus.jackson/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + diff --git a/docs/els-for-runtimes-and-libraries/java-libraries/README.md b/docs/els-for-runtimes-and-libraries/java-libraries/README.md new file mode 100644 index 00000000..3808e7e2 --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/java-libraries/README.md @@ -0,0 +1,237 @@ +# Java Libraries + +Endless Lifecycle Support (ELS) for Runtimes & Libraries from TuxCare provides security fixes for a variety of Java Libraries. This allows you to continue running your Java applications without vulnerability concerns, even after official support has ended. + +## Supported Java Libraries + +* **Apache Commons BeanUtils** 1.9.4 +* **Apache Commons HttpClient** 3.1 +* **Apache Commons IO** 2.7 +* **Apache Commons Lang** 2.4, 2.6, 3.4, 3.10, 3.12.0 +* **Apache CXF** 3.5.9 +* **Apache Hive** 2.3.9 +* **Apache Santuario XML Security For Java** 2.0.10, 2.3.1 +* **Apache Thrift** 0.9.3 +* **Apache Tomcat** 8.5.100, 9.0.75 +* **Apache Velocity Engine** 1.7 +* **DNSJava** 2.1.7 +* **Dom4j** 1.6.1 +* **el-spec** 3.0.0 +* **Google Guava** 20.0, 30.1-jre, 31.1-jre +* **Logback** 1.2.13 +* **Netty** 4.1.115.Final, 4.1.63.Final +* **Nimbus JOSE + JWT** 9.22, 9.24.4 +* **Okio** 2.8.0 +* **Plexus Utils** 1.5.8 +* **Querydsl** 5.1.0 +* **Reload4j** 1.2.17 +* **SnakeYAML** 1.23, 1.26, 1.29, 1.30, 1.33 +* **Snappy Java** 1.1.8.4 +* **Thymeleaf** 3.0.15.RELEASE +* **Woodstox** 5.0.3 +* **XMLUnit** 2.9.1, 2.9.0 + +Other libraries upon request. + +## Connection to ELS for Java Libraries Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Java Libraries repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Java Libraries repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + +Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Java Libraries repository and plugins to your build configuration: + + + +* To fully switch from the official Java Libraries repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +**Replace your dependencies (both direct and transitive, as needed) with the TuxCare-maintained ones, then rebuild your project.** + +Check [your TuxCare Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted) for the specific artifacts you need. If a BOM (Bill of Materials) or a parent POM is available, it’s recommended to use it to manage versions: + +* Example of **BOM (Bill of Materials)** usage: + + + +* Example of **parent POM** usage: + +* If no BOM or parent POM is provided, **update dependency versions directly** using the latest `.tuxcare` patches for your dependency versions. + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Java Libraries repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Java Libraries repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Java Libraries repository into your project. You can now benefit from the secure and vetted Java libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for Java Libraries ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + + + diff --git a/docs/els-for-runtimes-and-libraries/postgresql/README.md b/docs/els-for-runtimes-and-libraries/postgresql/README.md new file mode 100644 index 00000000..57b83eca --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/postgresql/README.md @@ -0,0 +1,162 @@ +# PostgreSQL + +TuxCare's Endless Lifecycle Support (ELS) for PostgreSQL provides security patches, and selected bug fixes, that are integral to the stable operation of applications using the PostgreSQL driver. + +## Supported Versions + +* PostgreSQL 42.2.16, 42.5.0 + +## Connection to ELS for PostgreSQL Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for PostgreSQL repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS PostgreSQL repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + + Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare PostgreSQL repository and plugins to your build configuration: + + + +* To fully switch from the official PostgreSQL repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the PostgreSQL dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare PostgreSQL repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for PostgreSQL repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for PostgreSQL repository into your project. You can now benefit from the secure and vetted PostgreSQL libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for PostgreSQL ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/org.postgresql/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.postgresql/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + + + diff --git a/docs/els-for-runtimes-and-libraries/protobuf/README.md b/docs/els-for-runtimes-and-libraries/protobuf/README.md new file mode 100644 index 00000000..bd20e239 --- /dev/null +++ b/docs/els-for-runtimes-and-libraries/protobuf/README.md @@ -0,0 +1,162 @@ +# Protobuf + +TuxCare's Endless Lifecycle Support (ELS) for Protobuf provides security patches, and selected bug fixes, that are integral to the stable operation of applications using Google Protocol Buffers. + +## Supported Versions + +* Protobuf 2.5.0 + +## Connection to ELS for Protobuf Repository + +This guide outlines the steps needed to integrate the TuxCare ELS for Protobuf repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects. + +### Step 1: Get user credentials + +You need username and password in order to use TuxCare ELS Protobuf repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). + +### Step 2: Configure Registry + +1. Navigate to the directory depending on your operating system. + * Windows + ```text + Maven: C:\Users\{username}\.m2 + Gradle: C:\Users\{username}\.gradle + ``` + * macOS + ```text + Maven: /Users/{username}/.m2 + Gradle: /Users/{username}/.gradle + ``` + * Linux + ```text + Maven: /home/{username}/.m2 + Gradle: /home/{username}/.gradle + ``` + +2. Add the TuxCare repository and plugin repository to your build configuration. + + :::tip + For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. + ::: + + + + Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials). + +### Step 3: Update Build Configuration + +Add the TuxCare Protobuf repository and plugins to your build configuration: + + + +* To fully switch from the official Protobuf repository, replace it with the TuxCare repository. +* To keep both, add TuxCare after the official one. + +Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. +* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) +* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) + +### Step 4: Update Dependencies + +Replace the Protobuf dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies. + +You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted). + + + +### Step 5: Verify and Build + +1. To confirm the TuxCare Protobuf repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath. + + + +2. After reviewing the dependencies, include any library from the repository into your project and then run a build: + + + +The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Protobuf repository. + +### Conclusion + +You've successfully integrated the TuxCare ELS for Protobuf repository into your project. You can now benefit from the secure and vetted Protobuf libraries it provides. + +## Vulnerability Exploitability eXchange (VEX) + +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks. + +TuxCare provides VEX for Protobuf ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/com.google.protobuf/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/com.google.protobuf/). + +## How to Upgrade to a Newer Version of TuxCare Packages + +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file. + + + +