Page Comparison

...

Time

Item

Who

Notes

20 min

Spring RCE vulnerability

All

See https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Jira Legacy
server System JiraJIRA
serverId 01505d01-b853-3c2e-90f1-ee9b165564fc
key FOLSPRINGB-47
Julian Ladisch is writing a script to check for vulnerable modules
A message/update was posted to #sys-ops: https://folio-project.slack.com/archives/C9BBWRCNB/p1648740057373649?thread_ts=1648728230.119219&cid=C9BBWRCNB

5 min

Update on

Jira Legacy

server	System JiraJIRA
serverId	01505d01-b853-3c2e-90f1-ee9b165564fc
key	FOLIO-3317

Axel

Axel Dörrer Should be removed from week to week agenda and Axel will monitor for progress and report back
MDEXP-487 has been verified and moved to an fixed version
MODEUS-139 has been moved to the next sprint

Today:

Deferred since Axel is not here.

5-10 min

Jira Legacy

server	System JiraJIRA
serverId	01505d01-b853-3c2e-90f1-ee9b165564fc
key	RMB-902

Jira Legacy

server	System JiraJIRA
serverId	01505d01-b853-3c2e-90f1-ee9b165564fc
key	OKAPI-1081

Team

Notes from previous week:

Discussions are ongoing, currently blocked on a decision being made.

Document the options on the wiki to facilitate these discussions and the decision making process.
- Julian Ladisch to take this on.
By this group? By the TC?
How do we constrain the module names? If so, where/how?
- Various restrictions: Postgres, Hosting infrastructure (Kubernetes/ECS/etc.)
What about the tenantId restrictions?
- Also part of the above discussion/decision.

Today:

Deferred. Further discussion once Julian finalizes the proposal, next week

5-10 min

Jira Legacy

server	System JiraJIRA
serverId	01505d01-b853-3c2e-90f1-ee9b165564fc
key	STCLI-190

Team

Notes from previous week:

There's a PR that hasn't' moved in a while... What's the status? How do we move this forward?

Ryan Berger / John Coburn to help push this along.

Was there another PR against stripes-testing?

already merged (ui-test:94)

Today:

Ryan and Zak are still working on retesting this, we'll check back next week

*

Review the Kanban board.

Team

We stayed late and reviewed a bunch of stories.

There are a bunch related to stripes-hot-loader which we deferred for now. We'll need to get to them at some point, but focused on the other issues today.

Action items

Julian Ladisch to document the options for restricting tenantId and module names on the wiki (Context:
Jira Legacy
server System JiraJIRA
serverId 01505d01-b853-3c2e-90f1-ee9b165564fc
key RMB-902
/
Jira Legacy
server System JiraJIRA
serverId 01505d01-b853-3c2e-90f1-ee9b165564fc
key OKAPI-1081
)

Versions Compared

Old Version 1

New Version Current

Key

Action items