Table of Contents 1 Intershop Official Statement 2 Information Regarding the Vulnerability 2.1 Severity Assessment 2.2 Official CVE Notification 2.3 Short Description Intershop Official Statement On April 1, 2022, Intershop received the first reports regarding the critical vulnerability within the Spring

Description Repro Steps Actual Behavior Potential vulnerability in OMT because of used Spring version. https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html null Bug null Verified Closed null Major AdoWorkItem 75697 Products Products OMT 0 Fixed in Commit 71307 Parent iom/4.0.0

Table of Contents Operating Environment Requirements System Requirements Operating Environment Requirements Container Orchestration Engine Version Kubernetes 1.22 Kubernetes Package Manager Version Helm 3.2 ( <= 3.6) IOM Helm Charts Version 2.0.0 or newer Hardware Processor x86 based (64bit) Clock Speed

Table of Contents Introduction General Information Release IOM 4.7 References What’s New IOM REST API RMA 2.12 - Property Operations and Replacement of RMA Changelog Release IOM 4.7.11 Release IOM 4.7.10 Release IOM 4.7.9 Release IOM 4.7.8 Release IOM 4.7.7 Release IOM 4.7.6 Release IOM 4.7.5 Release

Description There are appservers in the cluster that fail to restart. They seem to hang. Thread dumps show DeadlockDetectThread related to com.intershop.beehive.loaderapp.EnfinityClassLoader Found one Java-level deadlock: ============================= "http-bio-10054-exec-72": waiting to lock monitor

Description The SMC root schedule job CleanupBatchProcesses does remove all schedule job entries from ICM in case of not defined JobNames attribute and ExecutionAgeDays -1 value Steps to Repeat - setup ICM system 7.10.32.15 and execute dbPreparer - execute SMC root job CleanupBatchProcesses with attribute

Description response of /products/<sku> contains defaultCategory info in case this category is not available (e.g. due to Catalog Views), the REST API still shows this info -> a follow-up REST call to this category then leads to 404 -> if this info is used to render the breadcrumb, the customer sees

Description The DeleteAppendDomainSpecificStagingProcessor provides a wrong feature description which does lead to wrong replication transfer expectation Steps to Repeat The Operations BO GUI does describe the below feature behavior: "The DeleteAppendDomainSpecificStagingProcessor is used to replicate

Description CAAS customer production environment is still running into AS connection reset db issues with MS JDBC driver com.microsoft.sqlserver.mssql-jdbc-9.4.1.jre8.jar and orm.properties MaxIdle/MinIdle/MaxTotal definitions Steps to Repeat CAAS customer production environment is still running into

Name Update Product Assignments Domain SLDSystem Job Dependencies Update Search Indexes (SLDSystem) AcquiredResources Schedule: Update Product Assignments [<jobID>]; Products;Categories Cartridge bc_productbinding Pipeline UpdateProductAssignmentSnapshot-Start Affected Domain Objects CatalogCategory