[ANN] Apache Syncope 2.1.4

2019-04-23 Thread Francesco Chicchiriccò

The Apache Syncope team is pleased to announce the release of Syncope 2.1.4

Apache Syncope is an Open Source system for managing digital identities 
in enterprise environments, implemented in Java EE technology .


The release will be available within 24h from:
http://syncope.apache.org/downloads.html

Read the full change log available here:
https://s.apache.org/syncope214

Upgrading from 2.1.3? There are some notes about this process:
https://s.apache.org/wvOo

We welcome your help and feedback. For more information on how to report
problems, and to get involved, visit the project website at

http://syncope.apache.org/

The Apache Syncope Team



[ANN] Apache Syncope 2.0.13

2019-04-23 Thread Francesco Chicchiriccò

The Apache Syncope team is pleased to announce the release of Syncope 2.0.13

Apache Syncope is an Open Source system for managing digital identities 
in enterprise environments, implemented in Java EE technology .


The release will be available within 24h from:
http://syncope.apache.org/downloads.html

Read the full change log available here:
https://s.apache.org/syncope2013

Upgrading from 2.0.12? There are some notes about this process:
https://s.apache.org/8U9F

We welcome your help and feedback. For more information on how to report
problems, and to get involved, visit the project website at

http://syncope.apache.org/

The Apache Syncope Team




[ANNOUNCE] Apache Qpid Proton 0.27.1 released

2019-04-23 Thread Robbie Gemmell
The Apache Qpid (http://qpid.apache.org) community is pleased to announce
the immediate availability of Apache Qpid Proton 0.27.1.

Apache Qpid Proton is a messaging library for the Advanced Message Queuing
Protocol 1.0 (AMQP 1.0, ISO/IEC 19464, http://www.amqp.org). It can be used
in a wide range of messaging applications including brokers, clients,
routers, bridges, proxies, and more.

The release is available now from our website:
http://qpid.apache.org/download.html

Release notes can be found at:
http://qpid.apache.org/releases/qpid-proton-0.27.1/release-notes.html

Thanks to all involved,
Robbie


[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability

2019-04-23 Thread Robbie Gemmell
CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Qpid Proton 0.9 - 0.27.0.

Description:
The TLS support in Apache Qpid Proton 0.9 - 0.27.0 can under some
circumstances connect as a client to a TLS server that offers anonymous
ciphers irrespective of whether the client was configured to verify the
server's certificate or certificate against the hostname used to connect.

This means that an undetected man in the middle attack could be
constructed if an attacker can arrange to intercept TLS traffic.

Versions 0.9 - 0.27.0 are affected when using OpenSSL prior to 1.1.0. This
includes the Qpid Proton C library, and all language binding libraries using
it. Installations using the native Windows Schannel TLS implementation or
using OpenSSL 1.1.0 or later are not affected.

Note that this attack will not work if client certificate authentication is
in use as anonymous ciphers cannot be used in this case.

Resolution:
Anyone using an affected version with OpenSSL prior to 1.1.0 should upgrade
their installation to 0.27.1 or higher for fix to this vulnerability.

Credit:
This issue was identified by the Qpid developers.

References:
[1] https://issues.apache.org/jira/browse/PROTON-2014
[2] https://qpid.apache.org/cves/CVE-2019-0223.html


The Apache Software Foundation Announces Apache® PLC4X™ as a Top-Level Project

2019-04-23 Thread Sally Khudairi
[this announcement is available online at https://s.apache.org/ABqy ]

Open Source universal protocol adapter powers Industry 4.0 by connecting and 
integrating Industrial hardware and IoT edge gateways once blocked by 
closed-source, proprietary legacy systems, incompatible protocols, and vendor 
lock-in.

Wakefield, MA —23 April 2019— The Apache Software Foundation (ASF), the 
all-volunteer developers, stewards, and incubators of more than 350 Open Source 
projects and initiatives, announced today Apache® PLC4X™ as a Top-Level Project 
(TLP). Apache PLC4X also has the designation as being the 200th project to 
graduate from the Apache Incubator.

Apache PLC4X is a universal protocol adapter for creating Industrial IoT 
applications through a set of libraries that allow unified access to a wide 
range of industrial programmable logic controllers (PLCs) using a variety of 
protocols with a shared API. The project was originally developed at 
codecentric AG, and entered the Apache Incubator in December 2017.

"There is a lot of hype about 'Industry 4.0,' 'industrial IoT,' and 
'digitization', however, there's unfortunately been no viable way to access 
industrial PLCs from the Open Source world," said Christofer Dutz, Vice 
President of Apache PLC4X. "Apache PLC4X is the missing link between Open 
Source and the reality on today's industrial shop floor. We are proud that 
PLC4X is helping redefine how industrial software is created, and graduating as 
an Apache Top-Level Project is an important milestone in solidifying our 
project's maturity."

Connectivity and integration across industrial hardware and IoT edge gateways 
is often impossible with closed-source, proprietary legacy systems, 
incompatible protocols, and locked-in vendor solutions. Not only is Apache 
PLC4X an API for communicating with industrial hardware, it also provides a set 
of drivers for communicating using a variety of industrial protocols. In 
addition, PLC4X ships with a wide variety of integration modules to make it 
easy to use in other Open Source solutions and frameworks.

Companies needing unified access to any type of industrial PLCs are choosing 
Apache PLC4X  to capture actionable intelligence through a growing number of 
interconnected systems and sensors.

"We build industrial IoT solutions and do edge computing in the industrial 
ecosystem, thus PLC connection is an important concern for us but no part of 
our core business," said Julian Feinauer, CEO at pragmatic industries GmbH. "As 
there were no open alternatives, we used our own home-made stack for PLC 
communication and regularly had issues with edge cases or bugs. We moved to 
Apache PLC4X about half a year ago and already see the payoff of the initial 
efforts. Since moving to PLC4X we see a massive performance boost, have 
connectors to more types of PLCs, and reached very good stability."

"At first we intended to use OPC-UA to establish a connection between our 
software and the PLC in question," said Andreas Wieland, Technology Consultant 
at Intelligent Data Analytics GmbH & Co. KG. "We decided to switch to Apache 
PLC4X for various reasons. One of the major advantages PLC4X has over OPC-UA is 
a measurable performance improvement and higher responsiveness due to its 
direct low-level access of variables provided by the PLC. With PLC4X we are 
able to support a wide range of systems without additional effort or the need 
of making changes to our software while keeping compatibility to a number of 
well-known standards."

"Cost and lack of interoperability are significant hurdles in the digital 
transformation of the shop floor," said Dr. Boris Adryan, Chief Digital 
Organization at Merck KGaA. "Open Source software can help to overcome these 
hurdles. We've assessed Apache PLC4X on a training setup for chemical engineers 
and plant operators, and find it a valuable addition to our toolbox of OT/IT 
interfaces."

Written in Java with support for various protocols including S7-Step7, Modbus, 
EtherNet/IP, and Beckhoff ADS, future versions of Apache PLC4X will include 
versions in C++ and C#, as well as support for BACnet, Emerson DeltaV, 
KNXNet/IP, Profinet, and other protocols. In addition to providing integrations 
modular to Apache IoT projects such as Apache Camel, Apache Edgent 
(incubating), Apache Kafka, and Apache NiFi, the project is planning to also 
add Apache Brooklyn and Apache Mynewt, among others.

"The past two years have been very challenging, but also very rewarding. It is 
clear how Apache PLC4X can really help make a difference, and we’re excited to 
build upon our work thus far," added Dutz. "We invite those interested to join 
us and help bring the benefits of The Apache Way in developing open software, 
open communities, and sharing knowledge to the industry."

Catch Apache PLC4X in action at Jug Thüringen (18 June in Erfurt, Germany), 
ApacheCon North America (9-12 September in Las Vegas, United States), and 
ApacheCon Europe (22-24