Blogs
How to build binary patches for older Liferay version from source code
Dominik Marks
Introduction
There is a security problem around that affects several Liferay version from 6.1.x to 7.2.0. Usually Liferay only provides fixes for the latest Community Edition. This time the issues CVE-2020-7961 is rather critical, so Liferay decided to offer source code patches even for pretty old versions too.
Thank you guys!
We already see attacks to our Liferay servers as well as to Liferay installations we provide on customer order. As upgrading to the latest Liferay version is not always an immediate option we had a look at how to create appropriate binary patches for the Liferay installations. The goal was to create real patches for the installations and not to create completely new Liferay versions. Those binary patches should be appliable to existing installations and it should be possible to integrate them into new installations, e.g. by creating updated Docker images.
The following will show how we at CONVOTIS reacted to the situation and how we created those patches. All patches have been created on a Windows 10, 64-bit system and have been applied to normal "Liferay with Tomcat" bundles.
Please note that the patches should be applied to the latest minor version of that branch only. Older versions should be updated to the latest minor version first.
Liferay 6.2.5 GA 6
An graphical overview of the changes can be found on GitHub. The following software is required:
- git for Windows
- Java JDK 1.7
- Ant 1.9.14
The following commands need to be executed:
git clone --depth 1 --no-tags --branch 6.2.5-cumulative https://github.com/community-security-team/liferay-portal.git
cd liferay-portal
# set JAVA_HOME to a 1.7 JDK
set JAVA_HOME=C:\PROGRA~2\Java\jdk1.7.0_80
set ANT_OPTS="-Xmx1024m"
ant -buildfile build-dist.xml unzip-tomcat
ant all
# A message appears: Task cannot continue because ECJ is not installed. ECJ was automatically installed. Please rerun your task.
ant all
The above took about 45 mins. After that you can find a bundled Liferay in the bundles directory. To create a binary patch we looked at the provided source code patches and extracted all files or libraries which contain changes. The following files need to be extracted to create the "binary patch".
- bundles\tomcat-7.0.42\webapps\ROOT\WEB-INF\lib
- commons-codec.jar
- commons-collection.jar
- commons-collection4.jar
- commons-compress.jar
- commons-exec.jar
- commons-fileupload.jar
- commons-io.jar
- fontbox.jar
- groovy.jar
- httpclient.jar
- httpcore.jar
- isoparser.jar
- jabsorb.jar
- java-libpst.jar
- jempbox.jar
- jhighlight.jar
- jmatio.jar
- jodd.jar
- metadata-extractor.jar
- pdfbox.jar
- poi-ooxml-schemas.jar
- poi-ooxml.jar
- poi-scratchpad.jar
- poi.jar
- rometools.jar
- tika-core.jar
- tika-parsers.jar
- vorbis-java-core.jar
- vorbis-java-tika.jar
- xmpcore.jar
- xz.jar
- portal-impl.jar
- util-taglib.jar
- util-java.jar
- bundles\tomcat-7.0.42\lib\ext
- portal-service.jar
- bundles\tomcat-7.0.42\webapps\ROOT\WEB-INF
- liferay-portlet.xml
- portlet-custom.xml
- bundles\tomcat-7.0.42\webapps\ROOT\html
- portlet\workflow_definitions\edit_workflow_definition.jsp
- portlet\workflow_definitions\init.jsp
- portlet\workflow_definitions\toolbar.jsp
- portlet\workflow_definitions\workflow_definition_action.jsp
- taglib\portlet\runtime\error.jsp
- portlet\users_admin\user\password.jsp
- taglib\aui\input\page.jsp
- taglib\ui\input_field\page.jsp
- common\themes\layout_friendly_url_redirect.jsp
- portlet\amazon_rankings\configuration.jsp
- portlet\document_library\edit_folder.jsp
- portlet\dynamic_data_lists\edit_record_set.jsp
- portlet\shopping\edit_order.jsp
- taglib\ui\navigation\page.jsp
- js\liferay\look_and_feel.js
- portlet\portlet_css\view.jsp
- bundles\tomcat-7.0.42\webapps\ROOT\WEB-INF\tld
- liferay-ui.tld
To apply the patch to an existing Liferay installation just copy the above files into the installation and overwrite all files found. After that clear the following directories inside the Liferay installation:
- bundles\tomcat-7.0.42\temp
- bundles\tomcat-7.0.42\work
Note: We had some issues with the blog portlet in 6.2.5 after applying the patch. There was a NullPointerException in [BlogsEntryLocalServiceImpl:1485] Pinging Google at http://blogsearch.google.com/ping....
Setting this portal.properties solved the problem for us:
blogs.ping.google.enabled=false
Liferay 7.0.6 GA 7
An graphical overview of the changes can be found on GitHub. The following software is required:
- git for Windows
- Java JDK 1.8, 64-bit
- Ant 1.10.7
Some problems occured when trying to compile Liferay 7.0.6 from source. Therefore we made the following modifications to be able to compile it successfully.
-
Downloading a patched Apache Ivy failed. So we downloaded it manually and put it into the following local directory (
%USERPROFILE\.liferay\mirrors\cdn.lfrs.sl\repository.liferay.com\nexus\content\repositories\liferay-public-snapshots\com\liferay\org.apache.ivy\2.4.0.LIFERAY-PATCHED-1-SNAPSHOT) -
Compiling the additional themes failed. So we deleted the
frontend-theme-xxxxdirectories from the sources. They are not part of a normal Liferay bundle, so we don't need them here. -
Compiling took much time at first. So we excluded the directories above from virus scanning by the Windows Defender.
-
Probably because of a known bug LPS-107951 the exported package versions from the
portal-kernel.jarmismatched the versions in the source code. So we had to patch one file afterwards. Inside thecom.liferay.blogs.service.jarwe had to update the following lines in theMANIFEST.MFfile:
com.liferay.portal.kernel.util;version="[7.41,8)"
com.liferay.blogs.kernel.service;version="[1.0,2)
The following commands are being executed:
git clone --depth 1 --no-tags --branch 7.0.6-cumulative https://github.com/community-security-team/liferay-portal.git
cd liferay-portal
# set JAVA_HOME to a JDK 1.8, 64-bit
set JAVA_HOME=C:\PROGRA~1\Java\jdk1.8.0_231
set ANT_OPTS="-Xmx4096m"
ant -buildfile build-dist.xml unzip-tomcat
ant all
The above took about 60 mins. After that you can find a bundled Liferay in the bundles directory. To create a binary patch we looked at the provided source code patches and extracted all files or libraries which contain changes. The following files need to be extracted to create the "binary patch".
- bundles\osgi\marketplace\override (copy them from bundles\osgi\modules, bundles\osgi\static or bundles\osgi\portal)
- com.liferay.blogs.service.jar
- com.liferay.blogs.web.jar
- com.liferay.dynamic.data.lists.form.web.jar
- com.liferay.dynamic.data.mapping.form.renderer.jar
- com.liferay.dynamic.data.mapping.data.provider.impl.jar
- com.liferay.dynamic.data.mapping.data.provider.web.jar
- com.liferay.configuration.admin.web.jar
- com.liferay.marketplace.api.jar
- com.liferay.marketplace.app.manager.web.jar
- com.liferay.marketplace.deployer.jar
- com.liferay.marketplace.service.jar
- com.liferay.marketplace.store.web.jar
- com.liferay.portal.workflow.definition.web.jar
- com.liferay.portal.workflow.kaleo.definition.impl.jar
- com.liferay.portal.workflow.lang.jar
- com.liferay.portal.template.freemarker.jar
- com.liferay.portal.template.soy.jar
- com.liferay.portal.template.velocity.jar
- com.liferay.portal.template.xsl.jar
- com.liferay.portal.workflow.api.jar
- bundles\tomcat-8.0.32\webapps\ROOT\WEB-INF\lib
- portal-impl.jar
- bundles\tomcat-8.0.32\webapps\ROOT\html
- taglib\ui\discussion\page.jsp
- bundles\tomcat-8.0.32\lib\ext
- portal-kernel.jar
- bundles\tomcat-8.0.32\webapps\ROOT\WEB-INF\lib
- commons-compress.jar
- tika-core.jar
- tika-parsers.jar
- pdfbox.jar
To apply the patch to an existing Liferay installation just copy the above files into the installation and overwrite all files found. After that clear the following directories inside the Liferay installation:
- bundles\osgi\state
- bundles\tomcat-8.0.32\temp
- bundles\tomcat-8.0.32\work
- bundles\work
Liferay 7.1.3 GA 4
An graphical overview of the changes can be found on GitHub. The following software is required:
- git for Windows
- Java JDK 1.8, 64-bit
- Ant 1.10.7
Compiling took much time at first. So we excluded the directories above from virus scanning by the Windows Defender.
The following commands are being executed:
git clone --depth 1 --no-tags --branch 7.1.3-cumulative https://github.com/community-security-team/liferay-portal.git
cd liferay-portal
# set JAVA_HOME to a JDK 1.8, 64-bit
set JAVA_HOME=C:\PROGRA~1\Java\jdk1.8.0_231
set ANT_OPTS="-Xmx4096m"
ant -buildfile build-dist.xml unzip-tomcat
ant all
The above took about 80 mins. After that you can find a bundled Liferay in the bundles directory. To create a binary patch we looked at the provided source code patches and extracted all files or libraries which contain changes. The following files need to be extracted to create the "binary patch". Some changes were made to third party modules which are not part of a normal Liferay bundle. We did not include those changes in the "binary patch" below.
- bundles\tomcat-9.0.17\webapps\ROOT\WEB-INF\lib
- commons-beanutils.jar
- jackson-annotations.jar
- jackson-core.jar
- jackson-databind.jar
- tika-core.jar
- tika-parsers.jar
- portal-impl.jar
- bundles\tomcat-9.0.17\lib\ext
- portal-kernel.jar
- bundles\osgi\marketplace\override (copy them from bundles\osgi\modules, bundles\osgi\static or bundles\osgi\portal)
- com.liferay.asset.taglib.jar
- com.liferay.blogs.service.jar
- com.liferay.blogs.web.jar
- com.liferay.calendar.web.jar
- com.liferay.configuration.admin.web.jar
- com.liferay.document.library.service.jar
- com.liferay.document.library.web.jar
- com.liferay.dynamic.data.mapping.form.builder.jar
- com.liferay.exportimport.web.jar
- com.liferay.fragment.web.jar
- com.liferay.frontend.editor.alloyeditor.web.jar
- com.liferay.frontend.js.lodash.web.jar
- com.liferay.hello.world.web.jar
- com.liferay.item.selector.taglib.jar
- com.liferay.item.selector.web.jar
- com.liferay.journal.taglib.jar
- com.liferay.layout.type.controller.asset.display.jar
- com.liferay.login.web.jar
- com.liferay.map.openstreetmap.jar
- com.liferay.message.boards.web.jar
- com.liferay.notifications.web.jar
- com.liferay.oauth2.provider.rest.jar
- com.liferay.petra.json.web.service.client.jar
- com.liferay.portal.odata.impl.jar
- com.liferay.portal.search.elasticsearch6.impl.jar
- com.liferay.portal.search.web.jar
- com.liferay.portal.security.sso.cas.impl.jar
- com.liferay.portal.security.sso.google.impl.jar
- com.liferay.portal.settings.authentication.ldap.web.jar
- com.liferay.portal.settings.lang.jar
- com.liferay.portal.settings.web.jar
- com.liferay.portal.store.s3.jar
- com.liferay.portal.template.freemarker.jar
- com.liferay.portal.template.velocity.jar
- com.liferay.portal.template.xsl.jar
- com.liferay.portal.vulcan.api.jar
- com.liferay.portal.vulcan.impl.jar
- com.liferay.portal.workflow.api.jar
- com.liferay.portal.workflow.kaleo.api.jar
- com.liferay.portal.workflow.kaleo.definition.impl.jar
- com.liferay.portal.workflow.kaleo.runtime.integration.impl.jar
- com.liferay.portal.workflow.kaleo.service.jar
- com.liferay.portal.workflow.lang.jar
- com.liferay.portal.workflow.web.jar
- com.liferay.site.navigation.menu.web.jar
- com.liferay.site.browser.web.jar
- com.liferay.site.item.selector.web.jar
- com.liferay.users.admin.web.jar
- bundles\osgi\static
- com.liferay.portal.osgi.web.wab.extender.jar
- org.apache.aries.cdi.extender.jar
- org.apache.aries.cdi.extension.http.jar
- bundles\tomcat-9.0.17\webapps\ROOT\html
- common\themes\top_js.jspf
- taglib\ui\breadcrumb\page.jsp
To apply the patch to an existing Liferay installation just copy the above files into the installation and overwrite all files found. After that clear the following directories inside the Liferay installation:
- bundles\osgi\state
- bundles\tomcat-9.0.17\temp
- bundles\tomcat-9.0.17\work
- bundles\work
Conclusion
Security is important. So consider creating patches for your older Liferay installations or plan an upgrade to a newer version.
After applying the patches you still have to check your customizations to Liferay. If you wrote JSP hooks or EXT plugins you have to carefully compare your changes with the ones from the patch. Otherwise you will probably revert some of the security fixes which will lead to an insecure Liferay again. Additionally check your configurations, too. Especially check custom configurations for Velocity or the Freemarker Engine. There are new default values which may have to be merged into your configuration. Otherwise you will actually revert some security fixes.
Disclaimer: I do not gurantee that creating the patches will work for you. I do not take any responsibility if the patches do not work, for any data loss or for a non-working or destroyed Liferay installation. Create backups first!
Related Assets...
More Blog Entries...
