Breadcrumbs

Release Notes

(3.4.2.02.1) Release Notes

Product: Expertflow Generic Connector
Component version: 3.4.2.02
Release notes version: 3.4.2.02.1
Baseline scan date:
Verification date:
Scan tool: Trivy filesystem scan of Maven pom.xml

Overview

This release hardens the Expertflow Generic Connector by remediating dependency vulnerabilities reported in the Maven dependency scan and by upgrading the build/runtime target from Java 8 to Java 11.

The updated pom.xml was verified with Trivy on and reports 0 vulnerabilities.

Highlights

  • Removed vulnerable Log4j 2.x dependency log4j-core:2.7, including Log4Shell exposure.

  • Replaced activemq-all:5.14.1 with supported client-only dependency activemq-client:5.19.8.

  • Removed end-of-life Apache Axis 1.4 dependencies and unused ZOOM/Axis code.

  • Upgraded Java target from 8 to 11 and added required Java 11 compatibility dependencies.

  • Updated supporting libraries including commons-lang3 and commons-codec.

  • Retained Log4j 1.x API compatibility through reload4j and slf4j-reload4j.

Security Fixes

CVE summary

Area

Before

Change

Impact

Log4j Core 2.7

8 CVEs, including CVE-2021-44228 Log4Shell

Removed org.apache.logging.log4j:log4j-core:2.7

Log4j 2.x vulnerability surface removed.

ActiveMQ All 5.14.1

10 CVEs identified on updated Trivy re-scan

Replaced with activemq-client:5.19.8

Removed unnecessary broker/web/Jolokia components and upgraded client dependency.

Apache Axis 1.4

5 CVEs, including unsupported Axis 1.x RCE risk

Removed Axis dependencies and unused ZOOM/Axis code

Removed end-of-life Axis vulnerability exposure.

Commons Lang3 3.5

1 CVE: CVE-2025-48924

Upgraded to commons-lang3:3.18.0

Resolved uncontrolled recursion vulnerability.

Vulnerability count

Metric

Before: original scan

Before: old pom re-scan with updated DB

After fix

Total

18

24

0

Critical

4

4

0

High

4

8

0

Medium

9

11

0

Low

1

1

0

The increase from 18 to 24 findings on the old pom.xml is due to newer ActiveMQ CVEs included in the updated Trivy vulnerability database. These findings are also resolved in this release.

Dependency Updates

Dependency

Before

After

Status

log4j-core

2.7

—

Removed

activemq-all

5.14.1

—

Removed

activemq-client

—

5.19.8

Added

axis / axis-jaxrpc

1.4

—

Removed

commons-lang3

3.5

3.18.0

Upgraded

commons-codec

1.6

1.17.1

Upgraded

commons-text

—

1.13.0

Added

reload4j

—

1.2.26

Added

slf4j-reload4j

—

2.0.17

Added

jaxb-api / jaxb-runtime

—

2.3.1 / 2.3.9

Added for Java 11

Java compile target

8

11

Updated

Platform / Runtime Change

The Generic Connector build and runtime target has been upgraded from Java 8 to Java 11.

Upgrade notes

  • Deployments must run this release using Java 11.

  • The service wrapper must point to a Java 11 executable by updating wrapper.java.command.

  • JAXB dependencies were added because JAXB is no longer provided on the default JDK classpath in Java 11.

  • Application logging continues to use the Log4j 1.x API (org.apache.log4j.*) through reload4j; Log4j 2.x is not used.

Verification

Verification was performed with Trivy against the updated Maven pom.xml.

Bash
trivy fs --scanners vuln --format table "Generic Connector/pom.xml"

Result after remediation: 0 vulnerabilities

Report Summary
┌─────────┬──────┬─────────────────┐
│ Target  │ Type │ Vulnerabilities │
├─────────┼──────┼─────────────────┤
│ pom.xml │ pom  │        0        │
└─────────┴──────┴─────────────────┘

Conclusion

Release 3.4.2.02.1 of the Expertflow Generic Connector resolves the reported dependency vulnerabilities, removes obsolete vulnerable components, upgrades key libraries, and moves the runtime target to Java 11. The remediated Maven dependency scan completed on with 0 vulnerabilities.