• State Suggested Answer
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 137 subscribers
  • Views 417 views
  • Users 0 members are here
Options
Related

Any users who successfully use TD14SP4 with a more recent version of Oxygen Author (25.1 and above) ?

Sowjanya Singamsetty

According to RWS documentation, Oxygen v23.x is supported for TD14SP4 Client tools. However, v23.1 has reached EOL and Oxygen identified high severity security advisory and released the fix in v25.1.

So, wanted to know if there are any users who tested/tried v25.1 or latest version of Oxygen Author with TD14SP4.

Security advisory detailing a high severity Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik 1.16, recommending upgrade to version 1.17 or later. Lists affected Oxygen XML Author products with fixed release availability.

Generated Image Alt-Text
[edited by: RWS Community AI at 2:29 PM (GMT 0) on 14 Nov 2024]
emoji
Rate translation
×
Suggest better translation
×
Parents
  • 0

    Hi Sowjanya,

    In short...
    You need at least 14SP4/14.0.4 build #6707 or higher - where higher includes Tridion Docs 15/15.0.0 and upward as well - to be allowed to install to non-verified combinations with Oxygen editor. So given this I see no blocker for trying besides the required software versions; but I'm also not aware of anyone attempting this combination so that is where the community could shime in.

    Some background...
    Security and a save code base is an important topic for us for all of us for a while now, see for example on https://www.veracode.com/verified/directory/rws-group where you can see we comply with Verified Status for a couple of years now.

    In this case, our Authoring Bridge component tighly integrates with the Oxygen xml editor. In turn from a security perspective we share issues.

    Near July 2022 we announced that 14SP4 General Availability (GA) build #5923 is now superseded with build #6707 (aka Maintenance Release 1; MR1). Besides aggregating hotfixes, it also unblocked the tight Oxygen vs Authoring Bridge connnection.

    • Authoring Bridge for Oxygen MSI installation package is less strict on Oxygen versions. From this build on, it should be possible to install the connector for any version of Oxygen. However, a warning will be shown when an Oxygen version is used that we do not support officially. When the installation feature window is shown, only the supported Oxygen versions will be preselected. The not supported versions of Oxygen can be selected if the customer accepts that this combination did not get proper validation by engineering.  [SCTCT-1008]

    Best wishes,
    Dave
    emoji
Reply
  • 0

    Hi Sowjanya,

    In short...
    You need at least 14SP4/14.0.4 build #6707 or higher - where higher includes Tridion Docs 15/15.0.0 and upward as well - to be allowed to install to non-verified combinations with Oxygen editor. So given this I see no blocker for trying besides the required software versions; but I'm also not aware of anyone attempting this combination so that is where the community could shime in.

    Some background...
    Security and a save code base is an important topic for us for all of us for a while now, see for example on https://www.veracode.com/verified/directory/rws-group where you can see we comply with Verified Status for a couple of years now.

    In this case, our Authoring Bridge component tighly integrates with the Oxygen xml editor. In turn from a security perspective we share issues.

    Near July 2022 we announced that 14SP4 General Availability (GA) build #5923 is now superseded with build #6707 (aka Maintenance Release 1; MR1). Besides aggregating hotfixes, it also unblocked the tight Oxygen vs Authoring Bridge connnection.

    • Authoring Bridge for Oxygen MSI installation package is less strict on Oxygen versions. From this build on, it should be possible to install the connector for any version of Oxygen. However, a warning will be shown when an Oxygen version is used that we do not support officially. When the installation feature window is shown, only the supported Oxygen versions will be preselected. The not supported versions of Oxygen can be selected if the customer accepts that this combination did not get proper validation by engineering.  [SCTCT-1008]

    Best wishes,
    Dave
    emoji
Children
No Data