Password Manager public hotfix - SSRF vulnerability (309416)

Password Manager public hotfix - SSRF vulnerability

Security fix provided for server side request forgery, where in an attacker can get the LDAP queries from PM Servers to another compromised server. Now the request is blocked by allowing domain requests to only configured domain lists.

Defect ID 127765

Please download the hotfix here.

 

NOTE: UI customizations will be lost during hotfix installation. If you have performed any UI customizations, before beginning the installation backup the current configuration by completing one of the following:

• • Export the configuration file using the Import/Export option in General Settings and import the same file after the upgrade.
  • Create a copy of the C:\ProgramData\One Identity\Password Manager folder and replace the same after upgrade.

  If you have customized the product settings in the below configuration files, before installing the hotfix back up the following files and re-configure them in the latest files after the installation of hotfix:

  • web.config files of all Password Manager websites
  • QPM.Service.Host.exe.config located at <Password Manager installation folder>\Service folder

  If you have customized any of the Password Manager files, then before installing the hotfix back up the customized file and re-configure the customizations in the latest files after the installation of hotfix.

1. Copy the supplied file PasswordManager-5.8.2-SOL309416.exe.rename to the One Identity Password Manager 5.8.2 computer.
2. Remove the .rename file name extension.
3. Run the file PasswordManager-5.8.2-SOL309416.exe and follow the on-screen instructions to complete the hotfix installation.
4. Perform Steps 1—3 for each instance of Password Manager installed in your environment.

 

TF00127765