Orbeon Vulnerabilities in Docker image scan

[Ádám Dobó]

Hi,

I'm running Orbeon PE 2023.1.3 version in a docker container with tomcat and nginx. When scanning the image for vulnerabilities, Docker Desktop detects 23 different vulnerabilities all coming from the ehcache-2.10.9.2.jar dependency from Orbeon.
Our client would like to eliminate these vulnerabilities, however as far as I know this is the latest version of ehcache 2. Is it possible to eliminate these vulnerabilities and keep Orbeon working at the same time?

Thank you for your help,
Adam

[ebruchez]

Adam,

You can completely eliminate Ehcache 2 by using, for example, Ehcache 3, by enabling the JCache provider. See:

https://doc.orbeon.com/installation/caches#enabling-jcache-providers

I hope this helps,

-Erik

[Ádám Dobó]

Thanks Erik for the fast response. Just to confirm: by switching to ehcache3 I can remove the ehcache2 jar file from Orbeon right?

Thanks,
Adam

[ebruchez]

> Just to confirm: by switching to ehcache3 I can remove the ehcache2 jar file from Orbeon right?

Yes, that's correct.

-Erik