Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
📙 You will learn
Pre-publishing warning: a note about defects created from mapped/unmapped vulns was added near the bottom for the 2.8.6 based on this ticket. Nothing else was added/changed prior to 2.8.6.Jira Legacy | ||||||
---|---|---|---|---|---|---|
|
How to upgrade from 2.8.5 or 2.8.5.1 to 2.8.6.1
Prerequisites
Audience: IT Professional and/or End User
Difficulty: Advanced
Time needed: Approximately 60 minutes
Tools required: Tomcat, MySQL or MS SQL Server
Note |
---|
ALWAYS PERFORM A FULL BACKUP OF YOUR DATABASE BEFORE ATTEMPTING ANY UPGRADE! MySQL Server: You can run the MS SQL Server: Using SSMS, right-click on the database, select Tasks → Back Up…, then choose the location & name of the backup file and click OKname of the backup file and click OK. |
Warning |
---|
The National Vulnerability Database has identified a high risk exploit, Spring4Shell, which affects applications running Tomcat as a WAR deployment. To mitigate risk of exposure ThreadFix recommends users update their Tomcat to the latest (8.5.78 at a minimum) in addition to upgrading to ThreadFix 2.8.6.1. |
If you have any questions or concerns or if you wish to upgrade from an older version of ThreadFix, please reach out to our support team here: support@threadfix.it
ThreadFix Deployment Update
Follow these steps to deploy the updated version of ThreadFix:
Stop the Tomcat instance on which ThreadFix is running.
Move your current ThreadFix deployment directory from your Tomcat webapps folder into a backup directory.
webapps directory location: //TOMCAT_HOME/webapps
Copy the updated ThreadFix folder from your new artifact into your webapps directory.
webapps directory location: //TOMCAT_HOME/webapps
Copy the following files from your backed up ThreadFix directory to the newly updated ThreadFix directory:
(FROM: <previous-threadfix-deploy>/WEB-INF/classes/, TO: <new-threadfix-deploy>/WEB-INF/classes/, except as noted below)custom.properties
ESAPI.properties
If upgrading from 2.8.5, see REQUIRED update below
:
Be sure that
Log4jfactory
is no longer referenced as theESAPI.Logger
in yourESAPI.properties
.Replace with
ESAPI.Logger=com.denimgroup.threadfix.logging.esapi.slf4j.CustomESAPISlf4jLogFactory
jdbc.properties
jms.properties
threadfix.license
If you've updated any of these in your previous deployment, copy them as well:
<threadfix-deploy>/WEB-INF/security.xml
If upgrading from 2.8.5, see REQUIRED update below:Replace bean definition in
security.xml
file:<bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/>
With:
<bean id="velocityEngine" class="com.denimgroup.threadfix.service.saml.CustomSamlVelocityFactory" factory-method="getEngine"/>
<threadfix-deploy>/WEB-INF/classes/security/samlKeystore.jks (and/or any other Java keystore that you've saved in this directory)
Note: If upgrading from 2.8.5, do not copy log4j.xml. As of version 2.8.5.1, log4j.xml was replaced with logback.xml, so there’s no need to copy log4j.xml from your previous artifact.
Any changes that you had made in log4j.xml will need to be made in logback.xml if you want them to persist.
Copy the velocityTemplates directory from your backed up ThreadFix directory to the newly-updated ThreadFix directory.
(FROM: <previous-threadfix-deploy> TO:<new-threadfix-deploy>)In Linux environments, you may need to grant your tomcat user/group ownership and permissions to the newly-deployed artifact.
Examples:Code Block sudo chown -R tomcat:tomcat /opt/tomcat sudo chmod -R 775 /opt/tomcat
Cleanup - Delete the following:
The contents of the <tomcat-deploy>/work directory
Your web browser's cache/history
Defects created from vulnerabilities with dynamic finding data using the default velocity template will not print Parameter: ${parameter} when no parameter is present.
Before-Restart Database Updates
Database Updates
Note |
---|
Do Not Restart Tomcat If Scripts Do Not Complete If you receive an error when running before-restart database update scripts, please report the issue to Denim Group ThreadFix Support (create a ticket in Service Desk), including a screenshot of the script & error message. You should NOT proceed to start Tomcat until the issue is resolved. If you do, Hibernate may make unrecoverable changes that will require you to restore your database from backup. Caution/warning messages are OK; just not errors. |
Expand the MySQL or MS SQL Server code block to reveal the scripts:
Expand | ||
---|---|---|
| ||
|
Expand | ||
---|---|---|
| ||
|
Tip |
---|
Tips You can double-click inside a code block to select all of its contentTip For large scripts, it may be most efficient to save them to a .sql file and either drag & drop them into your UI-based database manager (e.g., SSMS or MySQL Workbench), or if using a CLI to access your MySQL server, you can use the following example command to execute the script:
|
Start Tomcat/ThreadFix
Restart Tomcat/ThreadFix.
Navigate to the login page to ensure that it loads as expected. If so, you may now log in and verify that the new version is installed; the version is included in the page footer after logging in.
Note |
---|
When launching the new deployment for the first time after deploying the update, ThreadFix may take a few minutes to make necessary schema updates, so there may be a delay in accessing the login page. Monitor the <tomcat-deploy>/logs/threadfix.log file to determine when it has finished, look for the second instance of the following event: Please do not interrupt this process by stopping Tomcat. |
Table of Contents
Table of Contents | ||
---|---|---|
|