SAP Crystal Reports Eclipse Java Library Release Plan and vulnerability Fixes

[indusrilanka38]

We are planning to use this library for development, and need to know following information related to this.

Question 1

Is there any release plan for crystal report eclipse java library? What is the frequency of releases?

Question 2

If vulnerabilities are found, how can we obtain fixes for that?

Question 3

What are the ways, we can get the technical support?

we are downloading crystal report eclipse java library from https://www.sap.com/cmp/td/sap-crystal-reports-eclipse-trial.html

[DonWilliams · Accepted solution]

Hello,

CR for Eclipse is based on the same code stream as CR Server/BOE Enterprise.

There used to be a 6 month support cycle for CR for Eclipse, that is no more. Now it's released whenever due to not much in the way of updates required.

dell.stinnett-christy , there is no single support case purchase anymore. Your option now is to purchase CR Server, it comes with a 1 year support contract, so if you have an issue to report you can use that to get the issue escalated.

https://www.sap.com/products/technology-platform/crystal-server.html

As for CVE's being reported only the High's are fixed. But you need to show how the CVE affects your implementation using the Libraries. They won't fix it for you just because a scanner finds an issue.

Most times the ones reported have no effect in your code.

Note also CR Server comes with a complete set of Libraries so you do have the option to use those, that way they will have the updates to the libraries if required.

Also, mark this as your favorite:

https://help.sap.com/docs/SAP_BUSINESSOBJECTS_BUSINESS_INTELLIGENCE_PLATFORM?version=4.2.9&locale=en...

You'll find all updated info here.

Note also that vulnerability's are not publicly posted due to the nature of them, so finding them is tough, unless you have a support contract. I don't suggest posting them here as they do mark them open to anyone.

Don

[DellSC]

You can keep track of updates by checking the Crystal for Eclipse wiki. Unfortunately, I haven't been able to find an official release schedule. Normally releases come out every 4 to 6 months and only the most recent is "officially" supported, although you can get help here for older versions.

If you find a vulnerability, first post here. If that doesn't get you an answer, you'll have to open a support case with SAP. If you don't have a support contract, you'll have to pay for the case. I am not an SAP employee, so I'm not sure whether there is a way to get that payment refunded if they determine it's really an issue.

-Dell