One Identity Safeguard for Privileged Sessions 6.2.0 - Release Notes

When storing hostnames and fully-qualified domain names in Channel policies, you can now configure SPS to use a custom domain name server to resolve the hostnames. For details, see "Creating and editing channel policies" in the Administration Guide.

You can verify the integrity of the plugins uploaded to SPS from the web interface.

Security package updates

bind9:

• CVE-2019-6471

bzip2:

• CVE-2019-12900

expat:

• CVE-2018-20843

glib2.0:

• CVE-2019-13012

libmspack:

• CVE-2019-1010305

linux:

• CVE-2018-12126

• CVE-2018-12127

• CVE-2018-12130

• CVE-2019-11085

• CVE-2019-11091

• CVE-2019-11478

• CVE-2019-11479

• CVE-2019-11815

• CVE-2019-11833

• CVE-2019-11884

mysql-5.7:

• CVE-2019-2737

• CVE-2019-2738

• CVE-2019-2739

• CVE-2019-2740

• CVE-2019-2741

• CVE-2019-2757

• CVE-2019-2758

• CVE-2019-2774

• CVE-2019-2778

• CVE-2019-2791

• CVE-2019-2797

• CVE-2019-2805

• CVE-2019-2819

nss:

• CVE-2019-11719

• CVE-2019-11729

openjdk-8:

• CVE-2019-2745

• CVE-2019-2762

• CVE-2019-2766

• CVE-2019-2769

• CVE-2019-2786

• CVE-2019-2816

• CVE-2019-2842

• CVE-2019-7317

openldap:

• CVE-2019-13057

• CVE-2019-13565

openssl:

• CVE-2018-0732

• CVE-2018-0735

• CVE-2018-0737

• CVE-2019-1543

patch:

• CVE-2019-13636

• CVE-2019-13638

postgresql-10:

• CVE-2019-10164

• CVE-2019-10208

python2.7:

• CVE-2018-1000802

• CVE-2018-14647

redis:

• CVE-2019-10192

sqlite3:

• CVE-2018-20346

• CVE-2018-20505

• CVE-2018-20506

• CVE-2019-8457

• CVE-2019-9936

• CVE-2019-9937

vim:

• CVE-2019-12735

walinuxagent:

• CVE-2019-0804

Ignore the actual result of the whoami request when checking the availability of an LDAP server

To check the availability of an LDAP server, SPS performs a "who am I" query against that server. If that query was disabled on the server, SPS treated the response as a sign of the server being down, even if it was handling other requests properly. This behavior has been changed and SPS now only checks if the server responds at all.

Low idle timeouts on LDAP servers not handled correctly

SPS did not correctly handle if an LDAP server closed idle sessions after less than 600 seconds. After this fix, idle timeout settings above 120s work correctly.

Connection data backup not available in the console menu

It is possible to manually initiate a backup process from the menu accessible via SSH or the appliance console. Due to a bug, only the system backup option was available there and the option to backup data associated with connection policies (such as audit trails) was not. This is now fixed and all backup options are available again.

Login page can redirect to arbitrary external sites

To streamline the login process, SPS was able to redirect the user to the site they originally wanted to access after a successful login. However, this feature also redirected the user to any URL if the login page was accessed through a properly crafted link. This made phishing attacks against the administrators of SPS easier, so the login page now only redirects to URLs on SPS itself.

On an extremely overloaded machine, the OCR scanning (indexing) process could crash

When the machine was so overloaded that the connection between the process that controls the OCR scanning and indexing operation (indexerworker) and the process doing the computation (indexerservice) was lost, the worker process tried to abort the processing but crashed. The index job might be finished successfully later. The problem was fixed and the worker process now handles this outage correctly.

Disk fill-up prevention should always deny incoming connections when limit is reached

Disk fill-up prevention has not denied incoming connections in the following case: IP forwarding was enabled for the NIC where the connection was coming from and a connection policy was configured to 'Use original target address of the client'. This issue has been fixed. All connections are now denied when disk fill-up limit is reached. Forwarded connections that do not match a connection policy, and therefore are not audited still pass trough the appliance even if disk fill-up limit is reached.

Session verdict is 'auth-fail' after a failed gateway authentication attempt even if it succeeds after a retry

If the user enters a wrong password or the gateway authentication attempt failed for another reason, the "verdict" for that session on the search interface remained "auth-failed", even if a second attempt was offered for the user and that succeeded. This logic is now fixed and the final authentication decision is used to decide the verdict of the session.

Console menu does not timeout

As a side-effect of an unrelated change, the console menu did not log off idle users after a timeout. This is now fixed and idle sessions are properly terminated.

Transferring files over 4GB not possible over RDP disk redirection

Files over 4GB transfers via RDP disk redirection over SPS got corrupted. This is now fixed and both download and upload of larger files is possible.

indexer-service cannot be reloaded multiple times within a short time

Reloading indexer-service occasionally returned with a false error message, even though it was actually reloaded. However, if you attempted to reload it again within a short time (within in ~3 seconds), the reload failed.

Core files are generated for ICA sessions

In certain situations after the client has closed an ICA session, SPS generated a core file. This has been corrected.

Search interface easier to use on smaller displays

Some of the controls on the search interface were difficult to use on displays with less than 1480 horizontal pixels. The design was made more responsive to accomodate for smaller displays, too.

RDP connection problems with certain client applications

If the client did not send a cookie when establishing the initial connection to SPS, SPS sent an invalid cookie to the target server, causing the server to terminate the connection. This has been corrected.

The /api/active-sessions endpoint responds with Internal Server Error (500)

The /api/active-sessions endpoint could respond only with Internal Server Error (500) in case of an error during DELETE. From now on the /api/active-sessions endpoint can respond with Not Found Error (404) if the given session id is not found in the list of active sessions.

Removed deprecated and duplicate fields from the search interface

Many no longer used or duplicate fields were offered in the selectors on the search interface which made them difficult to use. That list was reviewed and now only relevant fields are available to be selected.

Disk fill-up prevention should always deny incoming connections when limit is reached

Disk fill-up prevention has not denied incoming connections in the following case: IP forwarding was enabled for the NIC where the connection was coming from and a connection policy was configured to 'Use original target address of the client'. This issue has been fixed. All connections are now denied when disk fill-up limit is reached. Forwarded connections that do not match a connection policy, and therefore are not audited still pass trough the appliance even if disk fill-up limit is reached.

Prevent joining SPS nodes running different firmware versions to a cluster

Configuration (and cluster state) synchronization may not work if the Central Management and other cluster nodes are running different versions of SPS. In order to avoid possible misconfiguration, product version compatibility will now be validated during joining nodes to an SPS cluster.

Improved error detection of Elasticsearch database for audit information

If the Elasticsearch instance that acts as a backend for the audit database failed to start for some reason, it kept retrying (and failing) and never notified the user about the problem. The problem has been fixed and such problems are properly escalated.

Indexing status does not change on UI after successfully reindexing a failed session

If indexing of an audit trail failed for some reason and reindexing was triggered manually, the status of indexing was never updated on the UI even if reindexing was successful. This has been fixed and the latest and correct indexing status is shown in the interface at all times.

Stopping more data-producing processes when disk fillup prevention is triggered

The disk fillup prevention feature in SPS proactively stops traffic passing through if this usage reaches a predefined threshold to avoid more severe errors caused by the disk being filled up completely. Besides ongoing traffic there are several services that also produce data, which are now also stopped, providing further protection.