Any users who successfully use TD14SP4 with a more recent version of Oxygen Author (25.1 and above) ?

According to RWS documentation, Oxygen v23.x is supported for TD14SP4 Client tools. However, v23.1 has reached EOL and Oxygen identified high severity security advisory and released the fix in v25.1.

So, wanted to know if there are any users who tested/tried v25.1 or latest version of Oxygen Author with TD14SP4.

Security advisory for CVE-2022-44729 showing high severity SSRF vulnerability in Apache XML Graphics Batik, affecting Oxygen XML Author v25.1 and older.



Generated Image Alt-Text
[edited by: Trados AI at 6:52 AM (GMT 0) on 5 Mar 2024]
emoji
Parents
  • Hi Sowjanya,

    In short...
    You need at least 14SP4/14.0.4 build #6707 or higher - where higher includes Tridion Docs 15/15.0.0 and upward as well - to be allowed to install to non-verified combinations with Oxygen editor. So given this I see no blocker for trying besides the required software versions; but I'm also not aware of anyone attempting this combination so that is where the community could shime in.

    Some background...
    Security and a save code base is an important topic for us for all of us for a while now, see for example on https://www.veracode.com/verified/directory/rws-group where you can see we comply with Verified Status for a couple of years now.

    In this case, our Authoring Bridge component tighly integrates with the Oxygen xml editor. In turn from a security perspective we share issues.

    Near July 2022 we announced that 14SP4 General Availability (GA) build #5923 is now superseded with build #6707 (aka Maintenance Release 1; MR1). Besides aggregating hotfixes, it also unblocked the tight Oxygen vs Authoring Bridge connnection.

    • Authoring Bridge for Oxygen MSI installation package is less strict on Oxygen versions. From this build on, it should be possible to install the connector for any version of Oxygen. However, a warning will be shown when an Oxygen version is used that we do not support officially. When the installation feature window is shown, only the supported Oxygen versions will be preselected. The not supported versions of Oxygen can be selected if the customer accepts that this combination did not get proper validation by engineering.  [SCTCT-1008]

    Best wishes,
    Dave

    emoji
Reply
  • Hi Sowjanya,

    In short...
    You need at least 14SP4/14.0.4 build #6707 or higher - where higher includes Tridion Docs 15/15.0.0 and upward as well - to be allowed to install to non-verified combinations with Oxygen editor. So given this I see no blocker for trying besides the required software versions; but I'm also not aware of anyone attempting this combination so that is where the community could shime in.

    Some background...
    Security and a save code base is an important topic for us for all of us for a while now, see for example on https://www.veracode.com/verified/directory/rws-group where you can see we comply with Verified Status for a couple of years now.

    In this case, our Authoring Bridge component tighly integrates with the Oxygen xml editor. In turn from a security perspective we share issues.

    Near July 2022 we announced that 14SP4 General Availability (GA) build #5923 is now superseded with build #6707 (aka Maintenance Release 1; MR1). Besides aggregating hotfixes, it also unblocked the tight Oxygen vs Authoring Bridge connnection.

    • Authoring Bridge for Oxygen MSI installation package is less strict on Oxygen versions. From this build on, it should be possible to install the connector for any version of Oxygen. However, a warning will be shown when an Oxygen version is used that we do not support officially. When the installation feature window is shown, only the supported Oxygen versions will be preselected. The not supported versions of Oxygen can be selected if the customer accepts that this combination did not get proper validation by engineering.  [SCTCT-1008]

    Best wishes,
    Dave

    emoji
Children
No Data