Merge branch 'release/v3.68.1-4'

kahoona77 · cesmarvin · commit 9e275214a6f2 · 2024-08-07T13:44:46.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,8 +6,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [v3.68.1-4] - 2024-08-07
+### Changed
+- [#135] update base image to OpenJDK 11.0.24-1
+- update Alpine to 3.20.2-1
+
+### Security
+- [#135] close CVE-2024-41110
+
 ## [v3.68.1-3] - 2024-07-31
-### Changes
+### Changed
 - [#133] Create volume for local config
 
 ## [v3.68.1-2] - 2024-07-01
diff --git a/Dockerfile b/Dockerfile
@@ -1,8 +1,8 @@
 # registry.cloudogu.com/official/nexus
-FROM registry.cloudogu.com/official/java:11.0.23-3 as builder
+FROM registry.cloudogu.com/official/java:11.0.24-1 as builder
 LABEL maintainer="hello@cloudogu.com" \
     NAME="official/nexus" \
-    VERSION="3.68.1-3"
+    VERSION="3.68.1-4"
 
 WORKDIR /build
 
@@ -59,7 +59,7 @@ RUN set -o errexit \
   && cp /root/.m2/repository/org/apache/shiro/tools/shiro-tools-hasher/${SHIRO_VERSION}/shiro-tools-hasher-${SHIRO_VERSION}-cli.jar /build/shiro-tools-hasher.jar
 
 
-FROM registry.cloudogu.com/official/java:11.0.23-3
+FROM registry.cloudogu.com/official/java:11.0.24-1
 
 ENV SERVICE_TAGS=webapp \
     SERVICE_ADDITIONAL_SERVICES='[{"name": "docker-registry", "port": 8082, "location": "v2", "pass": "nexus/repository/docker-registry/v2/"}]' \
diff --git a/Jenkinsfile b/Jenkinsfile
@@ -37,7 +37,7 @@ node('vagrant') {
         }
 
         stage('Check Markdown Links') {
-            Markdown markdown = new Markdown(this, "3.11.0")
+            Markdown markdown = new Markdown(this, "3.12.2")
             markdown.check()
         }
 
diff --git a/Makefile b/Makefile
@@ -1,5 +1,5 @@
 MAKEFILES_VERSION=9.1.0
-VERSION=3.68.1-3
+VERSION=3.68.1-4
 
 .DEFAULT_GOAL:=dogu-release
 
diff --git a/docs/gui/release_notes_de.md b/docs/gui/release_notes_de.md
@@ -4,6 +4,9 @@ Im Folgenden finden Sie die Release Notes für das Sonatype Nexus-Dogu.
 
 Technische Details zu einem Release finden Sie im zugehörigen [Changelog](https://docs.cloudogu.com/de/docs/dogus/nexus/CHANGELOG/).
 
+## Release 3.68.1-4
+* Behebung von kritischem CVE-2024-41110 in Bibliotheksabhängigkeiten. Diese Schwachstelle konnte jedoch nicht aktiv ausgenutzt werden.
+
 ## Release 3.68.1-3
 
 Wir haben nur technische Änderungen vorgenommen. Näheres finden Sie in den Changelogs.
@@ -14,6 +17,6 @@ Wir haben nur technische Änderungen vorgenommen. Näheres finden Sie in den Cha
 
 ## Release 3.68.1-1
 
-> Das Release behebt kritische Sicherheitslücken ([CVE-2024-4956](https://github.com/advisories/GHSA-6cgv-69mq-8w7x)). Ein Update ist daher empfohlen.
+**Das Release behebt kritische Sicherheitslücken ([CVE-2024-4956](https://github.com/advisories/GHSA-6cgv-69mq-8w7x)). Ein Update ist daher empfohlen.**
 
 * Das Dogu bietet nun die Sonatype Nexus-Version 3.68.1 an. Die Release Notes von Sonatype Nexus finden Sie [hier](https://help.sonatype.com/en/sonatype-nexus-repository-3-68-0-release-notes.html).
diff --git a/docs/gui/release_notes_en.md b/docs/gui/release_notes_en.md
@@ -4,6 +4,9 @@ Below you will find the release notes for the Sonatype Nexus Dogu.
 
 Technical details on a release can be found in the corresponding [Changelog](https://docs.cloudogu.com/en/docs/dogus/nexus/CHANGELOG/).
 
+## Release 3.68.1-4
+* Fix of critical CVE-2024-41110 in library dependencies. This vulnerability could not be actively exploited, though.
+
 ## Release 3.68.1-3
 
 We have only made technical changes. You can find more details in the changelogs.
@@ -14,6 +17,6 @@ We have only made technical changes. You can find more details in the changelogs
 
 ## Release 3.68.1-1
 
-> The release fixes critical security vulnerabilities ([CVE-2024-4956](https://github.com/advisories/GHSA-6cgv-69mq-8w7x)). An update is therefore recommended.
+**The release fixes critical security vulnerabilities ([CVE-2024-4956](https://github.com/advisories/GHSA-6cgv-69mq-8w7x)). An update is therefore recommended.**
 
 * The Dogu now offers the Sonatype Nexus version 3.68.1. The release notes of Sonatype Nexus can be found [here](https://help.sonatype.com/en/sonatype-nexus-repository-3-68-0-release-notes.html).
diff --git a/dogu.json b/dogu.json
@@ -1,6 +1,6 @@
 {
   "Name": "official/nexus",
-  "Version": "3.68.1-3",
+  "Version": "3.68.1-4",
   "DisplayName": "Sonatype Nexus",
   "Description": "The Nexus Repository is like the local warehouse where all of the parts and finished goods used in your software supply chain are stored and distributed.",
   "Url": "http://www.sonatype.org/nexus",

Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ node('vagrant') {`
`37`	`37`	`}`
`38`	`38`
`39`	`39`	`stage('Check Markdown Links') {`
`40`		`- Markdown markdown = new Markdown(this, "3.11.0")`
	`40`	`+ Markdown markdown = new Markdown(this, "3.12.2")`
`41`	`41`	`markdown.check()`
`42`	`42`	`}`
`43`	`43`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"Name": "official/nexus",`
`3`		`- "Version": "3.68.1-3",`
	`3`	`+ "Version": "3.68.1-4",`
`4`	`4`	`"DisplayName": "Sonatype Nexus",`
`5`	`5`	`"Description": "The Nexus Repository is like the local warehouse where all of the parts and finished goods used in your software supply chain are stored and distributed.",`
`6`	`6`	`"Url": "http://www.sonatype.org/nexus",`