Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Select view

Select search mode

 
7 of 7

older lucee versions can't download extensions from refactored update provider due to redirects (i.e. 5.2)

Won't Fix

Description

PSA: Only supported versions of Lucee are 5.4 and 6+

5.2 has multiple CVEs and uses very old java libraries with their own additional CVEs

https://github.com/lucee/Lucee/blob/6.1/SECURITY.md

they also only download over http, which is another redirect from http to https to the extension cdn

WORKAROUND: copy extensions manually to /deploy folder

Due to security reasons, we will no longer be supporting insecure update providers (i.e https only, no http support)

You can also create a reverse proxy to serve content from https://update.lucee.org/ and https://extension.lucee.org/ via http and then edit your lucee-server.xml to use that custom update provider host instead

Anyone running these old versions in production are advised to upgrade immediately, 5.4 is our LTS release, supported until 2026

These are just some of the problematic libraries in core 5.2, not including extensions (or lucee rebundled jars)

Environment

None

Details

Assignee

Reporter

Priority

Labels

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Affects versions

Created 26 June 2024 at 08:15
Updated 26 June 2024 at 16:18
Resolved 26 June 2024 at 16:18

Activity

Show:

Zac Spitzer26 June 2024 at 12:37
Edited

would require port 80 to be open, then it will default to serving content directly, otherwise allowRedirect=boolean, default is true

Flag notifications