As of December 31st, 2023 ThreadFix 2.X has reached End of Life and is no longer supported. For any further information please contact the Success and Implementation team.

Upgrade from 2.8.6/2.8.6.1 to 2.8.7

Owned by Daniel Colon
Last updated: May 09, 2023 by Hruiz
4 min read

You will learn

How to upgrade from 2.8.6/2.8.6.1 to 2.8.7.

Prerequisites

Audience: IT Professional and/or End User
Difficulty: Advanced
Time needed: Approximately 60 minutes
Tools required: Tomcat, MySQL or MS SQL Server

ALWAYS PERFORM A FULL BACKUP OF YOUR DATABASE BEFORE ATTEMPTING ANY UPGRADE!

MySQL Server: You can run the mysqldump command from the MySQL server, e.g., mysqldump -u mydbuser -p mydatabase > path/to/backup.sql (we do not recommend using MySQL Workbench to perform the backup).

MS SQL Server: Using SSMS, right-click on the database, select Tasks → Back Up…, then choose the location & name of the backup file and click OK.

The National Vulnerability Database has identified a high risk exploit, Spring4Shell, which affects applications running Tomcat as a WAR deployment. To mitigate risk of exposure ThreadFix recommends users update their Tomcat to the latest (8.5.78 at a minimum) in addition to upgrading to ThreadFix 2.8.7.

If you have any questions or concerns or if you wish to upgrade from an older version of ThreadFix, please reach out to our support team here: support@threadfix.it

ThreadFix Deployment Update

Follow these steps to deploy the updated version of ThreadFix:

  1. Stop the Tomcat instance on which ThreadFix is running.

  2. Move your current ThreadFix deployment directory from your Tomcat webapps folder into a backup directory.

    1. webapps directory location: //TOMCAT_HOME/webapps

  3. Copy the updated ThreadFix folder from your new artifact into your webapps directory.

    1. webapps directory location: //TOMCAT_HOME/webapps

  4. Copy the following files from your backed up ThreadFix directory to the newly updated ThreadFix directory:
    (FROM: <previous-threadfix-deploy>/WEB-INF/classes/, TO: <new-threadfix-deploy>/WEB-INF/classes/, except as noted below)

    1. custom.properties

    2. ESAPI.properties

    3. jdbc.properties

    4. jms.properties

    5. threadfix.license

    6. If you've updated any of these in your previous deployment, copy them as well:

      1. <threadfix-deploy>/WEB-INF/security.xml

      2. <threadfix-deploy>/WEB-INF/classes/security/samlKeystore.jks (and/or any other Java keystore that you've saved in this directory)

  5. Copy the velocityTemplates directory from your backed up ThreadFix directory to the newly-updated ThreadFix directory.
    (FROM: <previous-threadfix-deploy> TO:<new-threadfix-deploy>)

     

  6. In Linux environments, you may need to grant your tomcat user/group ownership and permissions to the newly-deployed artifact.
    Examples:

    sudo chown -R tomcat:tomcat /opt/tomcat sudo chmod -R 775 /opt/tomcat

     

  7. Cleanup - Delete the following:

    1. The contents of the <tomcat-deploy>/work directory

    2. Your web browser's cache/history

 

Before-Restart Database Updates

Database Updates

 

Do Not Restart Tomcat If Scripts Do Not Complete

If you receive an error when running before-restart database update scripts, please report the issue to ThreadFix Support (create a ticket in Service Desk), including a screenshot of the script & error message.

You should NOT proceed to start Tomcat until the issue is resolved. If you do, Hibernate may make unrecoverable changes that will require you to restore your database from backup.

Caution/warning messages are OK; just not errors.

Expand the MySQL or MS SQL Server code block to reveal the scripts:

DROP PROCEDURE IF EXISTS dropIfFkConstraintExists; DELIMITER $$ CREATE PROCEDURE dropIfFkConstraintExists() BEGIN IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE INDEX_SCHEMA = DATABASE() AND TABLE_NAME = 'failedMap' AND INDEX_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId_fail') AND EXISTS (SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE INDEX_SCHEMA = DATABASE() AND TABLE_NAME = 'failedMap' AND INDEX_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId') AND EXISTS (SELECT * FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'failedmap' AND CONSTRAINT_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId_fail') AND EXISTS (SELECT * FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'failedmap' AND CONSTRAINT_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId') THEN ALTER TABLE failedMap DROP FOREIGN KEY fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId_fail; ALTER TABLE failedMap DROP FOREIGN KEY fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId; ALTER TABLE failedMap DROP INDEX fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId; ALTER TABLE failedMap ADD CONSTRAINT fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId_fail FOREIGN KEY (cicdPolicyStatusId) REFERENCES CICDPolicyStatus(id); ELSEIF EXISTS (SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE INDEX_SCHEMA = DATABASE() AND TABLE_NAME = 'failedMap' AND INDEX_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId_fail') AND NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE INDEX_SCHEMA = DATABASE() AND TABLE_NAME = 'failedMap' AND INDEX_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId') AND EXISTS (SELECT * FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'failedmap' AND CONSTRAINT_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId_fail') AND EXISTS (SELECT * FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'failedmap' AND CONSTRAINT_NAME = 'fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId') THEN ALTER TABLE failedMap DROP FOREIGN KEY fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId; END IF; END $$ DELIMITER ; CALL dropIfFkConstraintExists();
IF OBJECT_ID('[dbo].[fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId]', 'F') IS NOT NULL ALTER TABLE [dbo].[FailedMap] DROP CONSTRAINT fk_cicdPolicyStatus_passCriteriaSnapshot_cicdPolicyStatusId;

Start Tomcat/ThreadFix

  1. Restart Tomcat/ThreadFix.

  2. Navigate to the login page to ensure that it loads as expected. If so, you may now log in and verify that the new version is installed; the version is included in the page footer after logging in.

 

www.threadfix.it | www.coalfire.com
Copyright © 2024 Coalfire. All rights reserved.

This Information Security Policy is CoalFire - Public: Distribution of this material is not limited.