Bug Fixes (4.3.4)

Description

The Data Veracity Filters do not automatically refresh when the page is reopened for the second time.

Resolution

The issue is fixed. Data Veracity now loads the latest filters each time it is reopened.

Description

In the user documentation for udrRoute, there is a note saying that the function cannot be used within global APL scripts, which in practice seems to work fine.

Resolution

This note has now been removed from the user documentation.

Description

A cross-site scripting (XSS) vulnerability was identified in how certain internal system outputs were rendered when specific configurations were enabled. In affected versions, unescaped content could lead to script execution in the browser under certain circumstances.

Resolution

This issue has been resolved by ensuring that all relevant content is properly sanitized before rendering. Script execution is no longer possible in these scenarios, and all user-facing and internal outputs now follow strict HTML encoding standards.

Description

If you have a valid workflow with a dynamic field and then remove the dynamic field in an update of the workflow, the Desktop Client will indicate that the historic version is invalid if you switch to it. Desktop Online will not show the historical version as invalid.

Resolution

This problem has now been fixed, and validation works in both Desktops.

Description

Several issues were identified that could cause the system to prompt users to save a Workflow Template, even when no visible changes were made to the user interface: Oversensitive Route Change Detection: In some cases, double-clicking an agent could trigger a false-positive route change, prompting a save dialog. Incorrect Internal State: The system’s internal state for tracking route changes was sometimes inaccurate. This occurred if the state was not properly reset when entering or exiting Workflow Template Edit mode, or if unrelated agent configuration updates incorrectly modified the state. Internal Configuration Data Format Updates: Changes to the internal format of configuration data—resulting from bug fixes or feature enhancements—may also trigger a save prompt. This ensures that your saved configuration matches the latest required format.

Resolution

The issues related to oversensitive route change detection and incorrect internal state management have been resolved. Users should no longer receive unnecessary save prompts due to these causes. Workflow Template save prompts will still occur when configuration data is updated to a new internal format. This behavior is consistent with previous MediationZone versions and ensures compatibility with system upgrades. However, these prompts are relatively rare when a configuration was created in an older system just only a few versions apart. Note: You may encounter more frequent save prompts when importing configurations from MediationZone version 8.3 to version 9.0 or newer, due to significant architectural changes between these versions.

Description

If agents were missing from the system or lacked a valid license, opening a workflow would result in it hanging indefinitely.

Resolution

This issue has been resolved. Workflows containing missing or unlicensed agents can now be opened. An appropriate error message will be displayed in the UI, and the error will also be logged in the UI log file.

Description

Importing workflows with deprecated REST agent that contains workflow tables with OAUTH-related fields will cause class not found exception instead of converting into a Black Box agent.

Resolution

Detecting and bypass this specific exception in order allow the import to succeed and converting the deprecated REST agent into a Black Box agent.

Description

When using external references in the database profile the Data Masking did not resolve the external references and the table dropdown list remained empty.

Resolution

The external references are now resolved for the database profile and the table dropdown is filled with table names.

Description

When you have a large number of UDRs in a batch, or when you have a large number of sessions timing out at the end of a batch, you may get an Out of Memory error.

Resolution

This problem has been fixed by flushing the internal cache to the SQL database if it grows larger than the cache size defined in the Aggregation profile. The sessions that have timed out will be fetched from the SQL database in chunks no larger than the fetch size defined in the Aggregation profile.

Description

Generated UDR types cannot be viewed in Data Veracity Inspector.

Resolution

Corrected the issue to allow generated UDR types to be displayed in Data Veracity Inspector.

Description

After upgrading UEPE from version 4.2 to 5.0, Prometheus failed to scrape metrics from the operator pod, returning the error: Error scraping target: server returned HTTP status 400 Bad Request. This issue occurred due to a change in the kubebuilder framework, where the default secure setting for metrics was changed to true.

Resolution

To maintain backward compatibility during the upgrade, the default secure setting for metrics has been reverted to false. Prometheus should now be able to successfully scrape metrics from the operator pod.

Description

When using the SQL Forwarding Agent to forward UDRs containing empty field values (e.g., byte, integer, short, long, float, double, char, boolean, BigInteger, or BigDecimal), a NullPointerException occurs when attempting to read a null value.

Resolution

Improved the agent to handle null values in fields (e.g., byte, integer, short, long, float, double, char, boolean, BigInteger, and BigDecimal) without causing a NullPointerException.

Description

Some compilation errors in APL or Ultra Editor could cause an IndexOutOfBoundsException in the editor. This would make the actual error impossible to see in the GUI.

Resolution

The issue has been fixed, and the actual error is now displayed in the error dialog when validating code.

Description

The default column size for the Session ID column in SQL Aggregation is too small and often has to be manually increased.

Resolution

The default Session ID column size in SQL Aggregation has been increased.

Description

The default value for the oracle.pool.maxlimit property described in the documentation is “-1” while the actual default value is 10 for the platform and 50 for the ecd.

Resolution

The documentation has now been updated to state the correct default value.

Description

FTPS Collection Agent does not support file collection within subfolders. The checkbox was mistakenly included into the agent configuration and does not enable subfolder functionality even when the checkbox is selected.

Resolution

Remove the checkbox from the agent configuration to prevent confusion.

Description

The current version of hadoop-shaded-guava (1.1.1) has a vulnerability CVE-2023-2976.

Resolution

The hadoop-shaded-guava library is upgraded to 1.4.0 which does not have this vulnerability.

Description

When you run aggregation with File Storage in realtime and are not committing to disk (and thus are running in “memory only” mode), then there are some scenarios where the aggregation agent may fail with an “Invalidated Storage” error. This can happen if you have ECs disconnecting and reconnecting, since there are problems in the aggregation service reconnect logic.

Resolution

The issue has been resolved and the aggregation workflow will work as expected after it has reconnected

Description

Post requests in gzip format are not decoded and shows unreadable characters.

Resolution

Added the support for handling gzip-formatted post requests.

Description

When using SQL Storage in the aggregation profile, the “Force Read Only” option in the aggregation agent does not work correctly. Sessions may be updated even with this option set.

Resolution

This has now been fixed

Description

View the UDR feature in ECS Inspector search result, breaks when the UDR type has recursive fields

Resolution

Processed the field in the complex UDR type by calling the method recursively, so all fields within each subfield are handled.

Description

When trying to edit optional UDR fields in the UDR File Editor, you get an exception.

Resolution

This problem has now been fixed and optional fields can be edited without rendering an exception.

Description

When viewing udr after the fact that udr structure has been changed, view udr fails to show previous historic elements of the udr.

Resolution

The UltraTypeConverter method, skips processing the UDR fields if it sees a field is of type ByteArray which stops the rendering of historic field metadata in its trail. Allow to skip byte array field.

Description

In case of some errors returned by a DB, the primary error message is masked by MZ generated error message.

Resolution

All error messages are displayed in system log, so no information is lost in case of error.

Description

A critical CVE was detected in the Apache JGit library.

Resolution

While there was no immediate impact, Apache JGit has been upgraded to version 7.3 which mitigates the potential vulnerability

Description

When restarting the platform pod, Desktop Online becomes unresponsive. The problem can be solved by restarting the Desktop Online pod.

Resolution

This problem has now been fixed, and Desktop Online works as expected after restarting the platform pod.

Description

When UEPE is installed with TLS enabled, Prometheus fails to scrape metrics from the ECD pod, returning the error "Error scraping target: server returned HTTP status 403 Forbidden".

Resolution

The annotation "prometheus.io/scheme" has been added to the ECD pod. This allows Prometheus to correctly identify the pod’s metrics endpoint as HTTPS and scrape metrics successfully.

Description

CVE-2025-52999 was reported in a Google third party library dependency.

Resolution

The Google third party library dependency has now been upgraded and the vulnerability removed.

Description

A vulnerability was found in the Vaadin library.

Resolution

The Vaadin library has now bee updated and the vulnerability removed.

Description

A high-severity CVE-2025-5878 was detected in ESAPI. While only HTML encoding is used, ESAPI is end-of-life.

Resolution

ESAPI has been upgraded in core to mitigate the potential vulnerability.

Description

In some scenarios where an EC has recently been restarted and all needed classes have not yet been loaded, a configuration update could cause the EC classloader structure to become corrupt, resulting in classes being loaded by the incorrect classloader.

Resolution

This problem has now been fixed, and the classloader update should now be consistent.

Description

When you try to stop the workflow containing an SAP CC Notification agent, the workflow would continue running.

Resolution

The issue is fixed where the workflow now stops.

Description

If your password contains special characters, scripts fail and misuse the password in subsequent SQL scripts. The documentation does not explain how to escape special characters.

Resolution

To create an SAP HANA instance when the SYSTEM password contains special characters, you must escape each special character with a backslash and run the creation script with the escaped password.

Description

The SQL Aggregation schema definition, as displayed in the Aggregation Profile UI, was missing an index for the timeout field. In some cases this could cause serious performance issues.

Resolution

The index has been added in the SQL displayed in the UI.

Description

A Host Header Injection vulnerability is found on the web interface server where no Host Header validation support exists for the web interface server.

Resolution

Two properties have been introduced for the Platform and EC to enable Host Header validation for the web interface server. These properties are mz.webserver.strict.host.validation and mz.webserver.valid.hosts.

Description

A high-severity CVE affecting setuptools version 75.8.0 was identified via Dependency-Track in both the EC base Dockerfile and the Platform base Dockerfile.

Resolution

Setuptools has been upgraded to version 80.9.0 in both the EC and Platform base Dockerfiles to address the vulnerability.

Description

Improper handling of prepared statements caused the memory cleaning task to slow down under heavy traffic. This resulted in memory being allocated faster than it could be freed, leading to increased memory usage due to a lock bottleneck.

Resolution

Prepared statement handling has been corrected to ensure memory is freed promptly without blocking. This eliminates the lock bottleneck and improves memory management under load.

Description

When the New Kafka agent is used in a workflow package, Prometheus encounters the following error while scraping metrics: Error scraping target: expected equal, got "." ("INVALID") while parsing: "kafka_producer_kafka_metrics_count_count{client_id=\"\"SF49379_1." The client_id value in the exported metrics is incorrectly enclosed in double double-quotes (e.g., client_id=""SF49379_1""), which causes Prometheus to fail parsing the metric.

Resolution

The redundant double quotes have now been removed, and this error no longer occurs.

Description

There can be problems if you have a workflow using aggregation with SQL Storage, and try to deploy this using Workflow Packages. In this context it may fail to read sessions from the database if those sessions contain Ultra UDR types as sub fields.

Resolution

The reading of session data now works correctly even for UDRs defined inside a workflow package.

Description

When running workflows using Aggregation with Redis storage containing Ultra UDRs in a workflow package, you will get an error message.

Resolution

This problem has now been fixed and you can run workflows with Aggregation using Redis and containing Ultra UDRs in workflow packages.

Description

Multiple agents use the Netty library, and the same version of the library has been packaged by several of them. Due to the complex classloading setup—where both the platform and OSGi bundles can export Netty classes—different classloaders may load the same class, leading to ClassCastException errors.

Resolution

Redundant packaging of the Netty library across agents has been eliminated, which should resolve the class loading exceptions.

Description

Since the table with host and port is mandatory when configuring the TCP/IP processing agent, you will get an error if you have established connections to the remote host via APL and left the table empty.

Resolution

This has been fixed, and the table with host and port is no longer mandatory to fill in and you can select to only establish connections via APL.