Return
-
Title
Password Manager public hotfix - SSRF vulnerability -
Description
Security fix provided for server side request forgery, where in an attacker can get the LDAP queries from PM Servers to another compromised server. Now the request is blocked by allowing domain requests to only configured domain lists. -
Cause
Defect ID 127765 -
Resolution
Please download the hotfix here.
NOTE: UI customizations will be lost during hotfix installation. If you have performed any UI customizations, before beginning the installation backup the current configuration by completing one of the following:
- Export the configuration file using the Import/Export option in General Settings and import the same file after the upgrade.
- Create a copy of the C:\ProgramData\One Identity\Password Manager folder and replace the same after upgrade.
If you have customized the product settings in the below configuration files, before installing the hotfix back up the following files and re-configure them in the latest files after the installation of hotfix:
- web.config files of all Password Manager websites
- QPM.Service.Host.exe.config located at <Password Manager installation folder>\Service folder
If you have customized any of the Password Manager files, then before installing the hotfix back up the customized file and re-configure the customizations in the latest files after the installation of hotfix.
To install the hotfix- Copy the supplied file PasswordManager-5.8.2-SOL309416.exe.rename to the One Identity Password Manager 5.8.2 computer.
- Remove the .rename file name extension.
- Run the file PasswordManager-5.8.2-SOL309416.exe and follow the on-screen instructions to complete the hotfix installation.
- Perform Steps 1—3 for each instance of Password Manager installed in your environment.
NOTE: In the Web.config file available in\Web\User\ , from theQPM.UI.User.MVC" />: - Delete sessionIDManagerType="QPM.UI.User.MVC.Infrastructure.SessionIDManager, QPM.UI.User.MVC" phrase.
- Update the cookieless parameter value from "AutoDetect" to "UseDeviceProfile".
The phrase should be as follows:NOTE: Enable sticky session if you are hosting any site on the load balancer, as Admin, Helpdesk, and Self-service sites use session state management technique.Please refer to the included Release Notes for additional information.
-
Change Request
TF00127765