Summary:

Build Containers feature disabled from InstallAnywhere 2022 R1

Problem:

InstallAnywhere enables users to build docker images from their existing project file. This functionality uses an Open Source component – docker-java 0.10.4. We have noticed that this component now reports several security vulnerabilities.

Solution:

Revenera has chosen to hide the docker functionality, starting InstallAnywhere 2022 R1, by default, to makes sure there is no room for vulnerability exploit. Though the functionality is hidden, it can be enabled. A new property in com.zerog.ia.Designer.properties called designer.build.docker.container is added with default value set as ‘false’ which disables Build Containers. Setting this property to ‘true’ and relaunching the IDE will enable the functionality again.

Though the jar is still shipped from InstallAnywhere, if you are not using Build Containers functionality, the vulnerabilities cannot be exploited.

This feature will be completely End of Life in subsequent releases. If you have any questions or concerns, please reach out to our technical support team.