GeoServer Blog

GeoServer 2.25.2 Release

Jun 18, 2024 • Jody Garnett

GeoServer 2.25.2 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a stable release of GeoServer recommended for production use. This release is made ahead of schedule to address an urgent bug or security vulnerability (see CVE-2024-36401 below). GeoServer 2.25.2 is made in conjunction with GeoTools 31.2, and GeoWebCache 1.25.2.

Thanks to Jody Garnett (GeoCat) for making this release on behalf of GeoCat customers.

Security Considerations

This release addresses security vulnerabilities and is considered an essential upgrade for production systems.

  • CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions (Critical)
  • CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat (Moderate)
  • CVE-2024-34696 GeoServer About Status lists sensitive Environmental Variables (Moderate)
  • CVE-2024-35230 Moderate

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See the project security policy for more information on how security vulnerabilities are managed.

Demo Requests page rewritten

The Demo Request page has been rewritten to use JavaScript to issue POST examples. This provides a much better user experience:

  • Show Result lists the response headers to be viewed along side the returned result (with an option for XML pretty printing).
  • Show Result in a New Page is available to allow your browser to display the result.

The WCS Request Builder and WPS Request Builder demos now have the option to show their results in Demo Requests page. Combined these changes replace the previous practice of using an iframe popup, and have allowed the TestWfsPost servlet to be removed.

For more information please see the Demo requests in the User Guide.

Thanks to David Blasby (GeoCat) for these improvements, made on behalf of the GeoCat Live project.

  • GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Release notes

New Feature:

  • GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Improvement:

  • GEOS-11351 Exact term search in the pages’ filters

Bug:

  • GEOS-7183 Demo request/wcs/wps pages incompatible with HTTPS/PKI
  • GEOS-11416 GeoPackage output contains invalid field types when exporting content from PostGIS
  • GEOS-11430 CiteComplianceHack not correctly parsing the context

Task:

  • GEOS-11411 Upgrade to ImageIO-EXT 1.4.11
  • GEOS-11426 Rework community dependency packaging to use module’s dependencies
  • GEOS-11429 Split COG community module packaging based on target cloud provider
  • GEOS-11432 Upgrade to ImageIO-EXT 1.4.12

For the complete list see 2.25.2 release notes.

Community Updates

Community module development:

  • GEOS-11412 Remove reference to JDOM from JMS Cluster (as JDOM is no longer in use)
  • GEOS-11413 STAC uses inefficient dabase queries when asking for collections in JSON format

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.25 Series

Additional information on GeoServer 2.25 series:

Release notes: ( 2.25.2 | 2.25.1 | 2.25.0 | 2.25-RC )

Read More

GeoServer 2.24.4 Release

Jun 18, 2024 • Peter Smythe

GeoServer 2.24.4 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a maintenance release of GeoServer providing existing installations with minor updates and bug fixes. It also includes security vulnerability fixes.

GeoServer 2.24.4 is made in conjunction with GeoTools 30.4, and GeoWebCache 1.24.4.

Thanks to Peter Smythe (AfriGIS) for making this release.

Security Considerations

This release addresses security vulnerabilities and is considered an essential upgrade for production systems.

  • CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions (Critical)
  • CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat (Moderate)
  • CVE-2024-34696 GeoServer About Status lists sensitive Environmental Variables (Moderate)

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project security policy for more information on how security vulnerabilities are managed.

Demo Requests page rewritten

The Demo Request page has been rewritten to use JavaScript to issue POST examples. This provides a much better user experience:

  • Show Result lists the response headers to be viewed along side the returned result (with an option for XML pretty printing).
  • Show Result in a New Page is available to allow your browser to display the result.

The WCS Request Builder and WPS Request Builder demos now have the option to show their results in Demo Requests page. Combined these changes replace the previous practice of using an iframe popup, and have allowed the TestWfsPost servlet to be removed.

For more information please see the Demo requests in the User Guide.

Thanks to David Blasby (GeoCat) for these improvements, made on behalf of the GeoCat Live project.

  • GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Release notes

New Feature:

  • GEOS-11390 Replace TestWfsPost with Javascript Demo Page

Improvement:

  • GEOS-11311 Show a full stack trace in the JVM stack dump panel
  • GEOS-11369 Additional authentication options for cascaded WMS WMTS data stores
  • GEOS-11400 About Page Layout and display of build information
  • GEOS-11401 Introduce environmental variables for Module Status page

Bug:

  • GEOS-7183 Demo request/wcs/wps pages incompatible with HTTPS/PKI
  • GEOS-11202 CAS extension doesn’t use global “proxy base URL” setting for service ticket
  • GEOS-11331 OAuth2 can throw a “ java.lang.RuntimeException: Never should reach this point”
  • GEOS-11332 Renaming style with uppercase/downcase empty the sld file
  • GEOS-11382 The interceptor “CiteComplianceHack” never gets invoked by the Dispatcher Servlet
  • GEOS-11385 Demo Requests functionality does not honour ENV variable PROXY_BASE_URL
  • GEOS-11416 GeoPackage output contains invalid field types when exporting content from PostGIS
  • GEOS-11430 CiteComplianceHack not correctly parsing the context

Task:

  • GEOS-11318 Upgrade postgresql from 42.6.0 to 42.7.2
  • GEOS-11374 Upgrade Spring version from 5.3.33 to 5.3.34
  • GEOS-11375 GSIP 224 - Individual contributor clarification
  • GEOS-11393 Upgrade commons-io from 2.12.0 to 2.16.1
  • GEOS-11395 Upgrade guava from 32.0.0 to 33.2.0
  • GEOS-11397 App-Schema Includes fix Integration Tests
  • GEOS-11402 Upgrade PostgreSQL driver from 42.7.2 to 42.7.3
  • GEOS-11403 Upgrade commons-text from 1.10.0 to 1.12.0
  • GEOS-11404 Upgrade commons-codec from 1.15 to 1.17.0

For the complete list see 2.24.4 release notes.

Community Updates

Community module development:

  • GEOS-11040 Could not get a ServiceInfo for service Features thus could not check if the service is enabled
  • GEOS-11381 Error in OIDC plugin in combination with RoleService
  • GEOS-11412 Remove reference to JDOM from JMS Cluster (as JDOM is no longer in use)

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.24 Series

Additional information on GeoServer 2.24 series:

Release notes: ( 2.24.4 | 2.24.3 | 2.24.2 | 2.24.1 | 2.24.0 | 2.24-RC )

Read More

GeoServer 2.23.6 Release

Jun 13, 2024 • Jody Garnett

GeoServer 2.23.6 release is now available with downloads (bin, war, windows), along with docs and extensions.

This series has previously reached end-of-life, with this release issued to address an urgent bug or security vulnerability (see CVE-2024-36401 below).

This GeoServer 2.23.6 update is provided as a temporary measure. Rather plan to upgrade to a stable GeoServer 2.25.2 or maintenance GeoServer 2.24.4.

GeoServer 2.23.6 is made in conjunction with GeoTools 29.6, and GeoWebCache 1.23.5.

Thanks to Jody Garnett (GeoCat) for making this release on behalf of GeoCat customers.

Security Considerations

This release addresses security vulnerabilities and is considered an essential update for production systems.

  • CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions (Critical)
  • CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat (Moderate)

See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

  • GEOS-11327 Add warning about using embedded data directories
  • GEOS-11347 STAC Landing Page links should include root link

Bug:

  • GEOS-11331 OAuth2 can throw a “java.lang.RuntimeException: Never should reach this point”

Task:

For the complete list see 2.23.6 release notes.

Community Updates

Community module development:

  • GEOS-11348 JMS cluster does not allow to publish style via REST “2 step” approach
  • GEOS-11358 Feature-Autopopulate Update operation does not apply the Update Element filter
  • GEOS-11381 Error in OIDC plugin in combination with RoleService
  • GEOS-11412 Remove reference to JDOM from JMS Cluster (as JDOM is no longer in use)

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.23 Series

Additional information on GeoServer 2.23 series:

Release notes: ( 2.23.6 | 2.23.5 | 2.23.4 | 2.23.3 | 2.23.2 | 2.23.1 | 2.23.0 | 2.23-RC1 )

Read More

How to Implement Basic Security in Geoserver

Jun 5, 2024 • Milad Rafiei

GeoSpatial Techno is a startup focused on geospatial information that is providing e-learning courses to enhance the knowledge of geospatial information users, students, and other startups. The main approach of this startup is providing quality, valid specialized training in the field of geospatial information.

( YouTube | LinkedIn | Facebook | X )

How to Implement Basic Security in Geoserver

In this session, we want to discuss the Security section in GeoServer, Defining Users, Groups, and Roles, and Granting rights to created users. If you want to access the complete tutorial, simply click on the link.

Introduction

GeoServer has a robust security subsystem. Most of the security features are available through the Web Administration interface. In the Security panel, you can find links to set user properties and bind data to security rules. The basic idea is that you create users and roles, and then combine them with data rules to enable a specific set of access policies. You can also limit read and write access by role.

Defining users, groups, and roles

Security in GeoServer is based on a role system where each role defines a specific set of functions. You can assign roles to users and groups; that is, assign functions to real people using your system. To ensure data security, you must identify who is accessing your layers and services.

To organize your real users, GeoServer provides you with the user, group, and role concepts. With the first two, you can insert real people into the GeoServer security subsystem, and with roles, you can grant rights to real users.

User definition

In GeoServer, a user is someone entitled to use the system; it may be another software or a real person. When you add a user to the security system, GeoServer stores a username, uniquely identifying the user, a password, and a set of key/value pairs to store general information about it. You can disable a user at any time, preventing him from using the system.

Group definition

A group in GeoServer is a collection of users. It consists of a list of usernames that are part of the group, along with a unique group name that identifies it. Since GeoServer may have a large number of users, assigning roles to each individual user can be challenging. Therefore, groups can be created to simplify the process, allowing roles to be assigned based on the group membership of users.

Note. Considering that there are no dependencies between users, groups, and roles. A group can be disabled, but note that this only removes the roles deriving from the disabled group and does not disable the users belonging to the group.

Roles definition

GeoServer roles are associated with performing certain tasks or accessing particular resources. Roles are assigned to users and groups, authorizing them to perform the actions associated with the role.

Creating users and groups

To fully understand how security works in GeoServer, we will use a typical scenario. We want to restrict access to this data to only the organization’s members. Inside the organization, there are a few people editing data to create new data sets or to update existing ones, and many more members who need to read data to compose maps. There is also a need for an administrator to keep it all working. Lastly, we need to consider that our GeoServer site also contains data that should remain freely available. We will now create the security organization from an unsecured GeoServer as follows:

  • In the Security section of the left pane, click the Users, Groups, and Roles link. This link shows you the User Group Services configured. You will find the default service shipped with GeoServer. Click on the Name to edit it.
  • Select the Groups tab, then click on Add a new group.
  • Enter group_readers as a group name and leave the group Enabled. Do not assign any role to the new group as we will create specific roles later. Press the Save button.
  • Repeat the previous step to create the group_editors and group_admins groups. Your list should now show the three groups.
  • Now switch to the Users tab. Obviously, it lists the only existing user, that is, admin, as shown in the screen.
  • Click on the Add new user link, and add user_admin with a password of your choice, as Data Administrator.
  • Add “user_admin” to the “group_admins”, then press the Save button.
  • Repeat the previous step to create a user, user_editor as a member of the “group_editors” group, and user_reader as a “group_readers” group member. Your list now shows the three users.

We just created three users for the three groups and this may seem overkill to you. Consider them as templates for real users. In the real world, we do not want to have too many administrators; we will probably need several “user_readers” and “user_editors” processing the data. Now, we need to define what they can do on GeoServer.

Defining roles

A user or a group without any role assigned is useless. Now it is time to create roles and assign them to our users. Please refer to the following points:

  • From the User, Groups, and Roles section, select the Roles tab. You will find that two roles already exist. They are the administrative roles assigned to the admin account, and they grant access to all GeoServer configurations. Click on the Edit link
  • Switch to the Roles tab, then click on Add new role.
  • Enter role_reader as a new role name. We do not need a Parent role. A child role inherits all the rights from the Parent role, making it useful when you want to extend a basic role with more rights. Indeed, we will do this in the next step.
  • Press the Save button and then repeat the previous step to create the role_editor role. This time, select “role_reader” as the Parent role.
  • Press the Save button and then repeat the previous step to create the role_admin role. This time, select “role_editor” as the Parent role.
  • The final step is to associate a role to users or groups. Select the User, Groups, and Roles page from the left pane, then select the Groups list and click on the “group_readers” group to edit it. Add the “role_reader” role to the group and save it.
  • Now click on the “group_editors” group and associate it with the role_editor role.
  • Finally, associate the “group_admins” group to the “role_admin” role.

By defining roles and associating them to the users, we completed the definition of our organization. Now, we need to explore how data is bound to roles and users.

Accessing data and services

GeoServer supports access control at both the service level and at the per-layer or per-workspace level, allowing for restriction of service operations to authenticate users with specific roles. This helps in ensuring data security and controlling access to different layers or workspaces within the server. When working with layers, you can define rules that specify what a role can do on any specific layer.

The operations controlled are the view, write, and admin access. When granting read access on a layer, you enable a user to add it on a map; while granting write access you enable the user to update, create, and delete features contained in the layer. The admin access level enables the user to update the layer’s configuration.

Layer Security

We want to protect the dataset contained in the test workspace from unauthorized access while leaving the remaining layers freely available to all users. In this section, we will associate layers and roles:

  • Navigate to the Data > Security page. The rules list shows the two shipped with the default GeoServer configuration. The *.*.r rule is associated with the * roles. This means that “any user”, including the anonymous one, can access “any layer” from “any workspace” configured on GeoServer. The general format of the rules is: workspace.layer.accessMode.
  • Now click on the Add new rule link. In the rule editing page, select test as the Workspace and leave “*” as a Layer. Since we want to protect all layers in this workspace, the Access mode should be Read. Select the “role_reader” role and move it to the right list by clicking on the arrow. Press the Save button to create the reading rule.
  • Repeat the previous step to create a writing rule. Select Write as the access mode and “role_editor” as the role.
  • Repeat the previous step, then create the administration rule. In other words, select Admin as the Access mode and “role_admin” as the Role.
  • Press the Save button, on the rule list page, and then log off from the GeoServer web interface. If you try to access the layer preview anonymously, you won’t see any layers from the test workspace while all the others are still listed.
  • Now, log on as “user_reader”, with the password you assigned to him. Going back to the layer preview, you should see the test layers listed. Try the Open Layers preview page for the river layer. It works and you can use the data to compose maps.
  • However, “user_reader” can’t edit the styles associated with the layer or any other property. He would need admin rights granted for it; can you guess who the proper user will be?
  • Log on to GeoServer as “user_admin”. Now, the left pane is richer than it was when you were “user_reader”, but with fewer features than those visible to the GeoServer’s default admin role. Click on the Layer link; you will see only the layers belonging to the test workspace.
  • If you go on Layer preview and select the rivers layer again, can you see the map? Of course, you can. Because of roles inheritance, which you set when creating the roles. So, “role_admin” inherits all the rights from “role_editor”, and hence from “role_reader”.

In this session, we took a brief journey through GeoServer security. we discussed the Security section, Defining Users, Groups, and Roles, and Granting rights to created users in GeoServer. If you want to access the complete tutorial, simply click on the link.

Read More

GeoServer 2.25.1 Release

May 23, 2024 • Jody Garnett

GeoServer 2.25.1 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a stable release of GeoServer recommended for production use. GeoServer 2.25.1 is made in conjunction with GeoTools 31.1, and GeoWebCache 1.25.1.

Thanks to Jody Garnett (GeoCat) for making this release.

Security Considerations

This release addresses security vulnerabilities and is considered an essential upgrade for production systems.

2024-06-30 Update: The following mitigation has been provided:

  • CVE-2024-36401 Remote Code Execution (RCE) vulnerability in evaluating property name expressions (Critical)

    geoserver-2.25.1-patches.zip (replacing gt-app-schema, gt-complex and gt-xsd-core jars) has been provided by Andrea (GeoSolutions)

See project security policy for more information on how security vulnerabilities are managed.

Raster Attribute Table Extension

A new extension is available that takes advantage of the GDAL Raster Attribute Table (RAT). This data structure provides a way to associate attribute information for individual pixel values within the raster. This provides a table that links each cell value in the raster to one or more attributes on the fly.

Thanks to Andrea Aime (GeoSolutions) for the development and NOAA for sponsoring this new capability. Please see the user guide Raster Attribute Table support for more information.

  • GEOS-11376 Graduate Raster Attribute Table to extension

Release notes

New Feature:

  • GEOS-11267 CSW ISO extension multiple mappings should also have multiple queryable mappings
  • GEOS-11376 Graduate Raster Attribute Table to extension

Improvement:

  • GEOS-11306 Java 17 does not support GetFeature lazy JDBC count(*)
  • GEOS-11311 Show a full stack trace in the JVM stack dump panel
  • GEOS-11342 STAC should exclude items when the collection in path is wrong
  • GEOS-11359 Update MapML viewer to release 0.13.2
  • GEOS-11369 Additional authentication options for cascaded WMS WMTS data stores
  • GEOS-11377 RAT module: allow to reload/recompute the RAT
  • GEOS-11400 About Page Layout and display of build information
  • GEOS-11401 Introduce environmental variables for Module Status page

Bug:

  • GEOS-11202 CAS extension doesn’t use global “proxy base URL” setting for service ticket
  • GEOS-11236 WFS 2.0.0/GetFeature - Shapefile - “We have had issues trying to flip axis”
  • GEOS-11331 OAuth2 can throw a “ java.lang.RuntimeException: Never should reach this point”
  • GEOS-11332 Renaming style with uppercase/downcase empty the sld file
  • GEOS-11382 The interceptor “CiteComplianceHack” never gets invoked by the Dispatcher Servlet
  • GEOS-11385 Demo Requests functionality does not honour ENV variable PROXY_BASE_URL
  • GEOS-11392 ConcurrentModificationException while using proxy-base-ext

Task:

  • GEOS-11360 Upgrade Apache POI from 4.1.1 to 5.2.5
  • GEOS-11362 Upgrade Spring libs from 5.3.32 to 5.3.33
  • GEOS-11374 Upgrade Spring version from 5.3.33 to 5.3.34
  • GEOS-11375 GSIP 224 - Individual contributor clarification
  • GEOS-11388 Update ImageIO-EXT to 1.4.10
  • GEOS-11393 Upgrade commons-io from 2.12.0 to 2.16.1
  • GEOS-11395 Upgrade guava from 32.0.0 to 33.2.0
  • GEOS-11397 App-Schema Includes fix Integration Tests
  • GEOS-11402 Upgrade PostgreSQL driver from 42.7.2 to 42.7.3
  • GEOS-11403 Upgrade commons-text from 1.10.0 to 1.12.0
  • GEOS-11404 Upgrade commons-codec from 1.15 to 1.17.0

For the complete list see 2.25.1 release notes.

Community Updates

Community module development:

  • GEOS-11040 Could not get a ServiceInfo for service Features thus could not check if the service is enabled
  • GEOS-11330 OAuth2 kid verification should be optional
  • GEOS-11339 Introducing the Features Autopopulate Community Plugin
  • GEOS-11340 WFS Freemarker HTML Outputformat
  • GEOS-11345 STAC Conformance URIs need to be updated to v1.0.0
  • GEOS-11348 JMS cluster does not allow to publish style via REST “2 step” approach
  • GEOS-11358 Feature-Autopopulate Update operation does not apply the Update Element filter
  • GEOS-11381 Error in OIDC plugin in combination with RoleService
  • GEOS-11394 OGC APIs cannot handle time extent when the source data type is java.sql.Date

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.25 Series

Additional information on GeoServer 2.25 series:

Release notes: ( 2.25.1 | 2.25.0 | 2.25-RC )

Read More

 Announcements

 Vulnerability

 Tutorials

 Behind The Scenes

 Developer notes