GeoServer Enterprise 2024.5.2 Release Notes

This is a security update of GeoServer Enterprise 2024.5 containing the following changes.

GeoServer Enterprise Premium

GeoServer Enterprise 2024.5.2 is proudly open source with the patched GeoServer 2.26.x, GeoTools 32.x and GeoWebCache 1.26.x.

Security considerations:

• GeoCat respects the GeoServer coordinated vulnerability disclosure policy, contact us directly to discuss known security vulnerabilities mitigation and resolution availability.

• The following security vulnerabilities are addressed by this release:

  • GHSA-hgm3-wq4h-8vvq (Critical)

  • GHSA-rv5g-g2r9-58rj (Critical)

  • CVE-2024-45747 FreeMarker template access to sensitive methods (High)

  • GHSA-vv34-hm2r-7h59 (High)

  • GHSA-wc3v-48j7-xf57 (High)

  • GHSA-39mw-5chv-jh47 (High)

  • GHSA-xqwh-vc83-cp7g (High)

  • CVE-2025-27504 REST API coverage store upload validation (Moderate)

  • GHSA-m4x7-gx5p-4jjp (Moderate)

  • GHSA-rg89-jmrw-x26f (Moderate)

  GeoCat is committed to taking care of our customers and will provide more information as the above vulnerabilities are publicly disclosed. If you have any concerns please contact our help desk.

Update notes:

• FreeMarker templates are restricted from calling methods on sensitive classes, and most administrator editable templates are limited to getter methods. Use the GEOSERVER_FREEMARKER_ALLOW_LIST, GEOSERVER_FREEMARKER_BLOCK_LIST and GEOSERVER_FREEMARKER_API_EXPOSED application properties if a custom template is affected.

• JDBC user/group services, role services and authentication providers only accept known connection parameters for each driver. Use the GEOSERVER_JDBC_EXTRA_PARAMETERS application property to allow an additional parameter.

• REST API coverage store uploads, and images uploaded with a style, are checked to be readable before they are accepted. The GS_FILETYPES_UNRESTRICTED environment variable disables this check.

• Clustered deployments can share remember-me cookies using the GEOSERVER_REMEMBERME_KEY application property.

• WFS stored query definitions, and XML schema imports and includes, are resolved using the ENTITY_RESOLUTION_ALLOWLIST application property. Add any additional host referenced by a schema or stored query to the allow list.

• When URL checks are enabled, remote OWS references in an SLD document provided by the WMS sld or sld_body parameter are checked. Add a URL check rule for each remote service used.

Security integration for JWT Headers:

• Accepted issuers (iss) option, used to validate the token issuer

• Option to log sensitive token information while troubleshooting, disabled by default

• Remove duplicate role source choices

Additional improvements:

• LDAP user/group service option to convert a group member to the username used to search for that user

• REST API management of user/group services

• Improved dateline wrapping for maps in the Plate Carrée projection

• WMTS cascaded layers include legend URLs from the remote capabilities document

• INSPIRE service settings are saved when OGC API is installed

• SQL view layers refresh their attributes after the query is edited