frevvo Latest - This documentation is for frevvo v10.0. Not for you? Earlier documentation is available too.

Skip to end of metadata
Go to start of metadata

 
 

GA Release Matrix

The table lists the latest frevvo released versions.
Product Version Matrix
ProductLatest VersionRelease DateRelease Notes
frevvo Cloudv10.3.207/22/2022Detailed Release Notes
frevvo On Premisev10.1.1906/24/2022Detailed Release Notes
frevvo for Confluencev10.1.1906/24/2022Detailed Release Notes
frevvo Confluence Pluginsee ref


Confluence Add-on Release Notes
frevvo Database Connector

v2.6.4

2/2/2022

Database Connector Release Notes

frevvo Filesystem Connectorv.1.3.12/1/2022Filesystem Connector Release Notes
frevvo Google Connectorv3.0.6

2/1/2022

Google Connector Release Notes
frevvo SharePoint Connectorv1.1.42/1/2022SharePoint Connector Release Notes
frevvo API .NET Clientsee ref

Data API Client Libraries Releases


frevvo™ v10.0

Cloud Upgrade: October 31, 2020

On Premise Release: January 18, 2021

frevvo v10.0 is a major new release. Please see the Detailed Release Notes for specific version enhancements and tickets fixed. 


Security Vulnerabilities

The following security vulnerabilities have been addressed as follows:

  • Man in the middle - This has to do with executing the CGI Servlet. This servlet is disabled in the frevvo Apache tomcat distribution. Customers who choose to enable the servlet are responsible for ensuring security viz. adding filter etc.
  • Version Disclosures - Resolved by configuring the ErrorReportValve in \frevvo\tomcat\conf\server.xml file (in the Host section) as described in this Apache tomcat website. The parameter that needs to be modified is:

    <Valve className="org.apache.catalina.valves.ErrorReportValve" showServerInfo="false"/>
  • X-Frame-Options Header Not Set - Resolved by modification at the tomcat level. In-house customers can uncomment the HttpHeaderSecurityFilter provided in the tomcat web.xml. The filter is documented here. Specify the appropriate X-Frame-Options value in the antiClickJackingOption parameter - (SAMEORIGIN or ALLOW-FROM).

    Setting this parameter to SAMEORIGIN may interfere when embedding frevvo forms/flows in your website. Use ALLOW-FROM instead.

    Click the appropriate link below for filter examples.

    Example of filter with SAMEORIGIN
    <filter>
            <filter-name>httpHeaderSecurity</filter-name>
            <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    		<init-param>
    			<param-name>antiClickJackingOption</param-name>
    			<param-value>SAMEORIGIN</param-value>
    		</init-param>
            <async-supported>true</async-supported>
    </filter>
    
    <filter-mapping>
            <filter-name>httpHeaderSecurity</filter-name>
            <url-pattern>/*</url-pattern>
            <dispatcher>REQUEST</dispatcher>
    </filter-mapping>
    
    Example of filter with ALLOW-FROM for embedded forms
    <filter>
            <filter-name>httpHeaderSecurity</filter-name>
            <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    		<init-param>
    			<param-name>antiClickJackingOption</param-name>
    			<param-value>ALLOW-FROM</param-value>
    		</init-param>
    		<init-param> 
                <param-name>antiClickJackingUri</param-name> 
                <param-value> http://example.com:80/*</param-value> 
            </init-param>
            <async-supported>true</async-supported>
    </filter>
    
    <filter-mapping>
            <filter-name>httpHeaderSecurity</filter-name>
            <url-pattern>/*</url-pattern>
            <dispatcher>REQUEST</dispatcher>
    </filter-mapping> 

  • v10.0.20 Mitigation applied to Address Critical RCE (log4j / solr) Vulnerability Under Exploitation. The SOLR version on will be upgraded in a future release. Security checks may flag this vulnerability based on the version alone; however as long as you are running v10.0.20+ or you have applied the mitigation described in this article, you are not exposed to this vulnerability.







  • No labels