Page History

...

Sometimes the OFBIz code itself is not the culprit. OFBiz relies on many Java librairies, and if one of them has a flaw we can't always wait it's fixed to warn and protect our users. This is for instance what happened with the infamous 2015 Java unserialize vulnerability. OFBiz was affected by 2 librairires: Commons Collections

Jira
server ASF JIRA serverId 5aa69414-a9e9-3523-82ec-879b028fb15b key OFBIZ-6726

and Groovy

Jira
server ASF JIRA serverId 5aa69414-a9e9-3523-82ec-879b028fb15b key OFBIZ-6568

. As you can see at OFBIZ-67366726, we waited the Commons Collections update to fix the issue, because it was not much disclosed then. But with the article above the buzz began to spread and we could not wait to be able to update Groovy. So a temporary workaround was adopted as explained in OFBIZ-6568.

Warning
title Be safe!
Until we update the Groovy librairy, we recommend you to have a look at http://svn.apache.org/viewvc?view=revision&revision=1717058 and so to use the start-secure ant target rather than the start one, or any other possibilities offered by OFBIZ-6568 (startofbiz.sh/bat, etc). Actually it's just a matter of calling "-javaagent:pathTo/contrast-rO0.jar" in your starting script. Also to have an historical view on the OFBiz security you can refer to Jira server ASF JIRA serverId 5aa69414-a9e9-3523-82ec-879b028fb15b key OFBIZ-1525

From what you can see there you can secure OFBiz using "-javaagent:pathTo/contrast-rO0.jar" in your starting script". and will be covered from these vulnerabilities which exist OOTB as long as we don't solve OFBIZ-6568

• org.codehaus.groovy.runtime.ConvertedClosure
• org.codehaus.groovy.runtime.MethodClosure

Those are already covered by OFBIZ-6726

• org.apache.commons.collections.functors.InvokerTransformer
• org.apache.commons.collections4.functors.InvokerTransformer
• org.apache.commons.collections.functors.InstantiateTransformer
• org.apache.commons.collections4.functors.InstantiateTransformer

We don't use

• org.springframework.beans.factory.ObjectFactory

But if you do you be sure to fix your issue or use "-javaagent:pathTo/contrast-rO0.jar" in your starting script" 

Roughly there are 3 categories of OFBiz users:

...