Bug Fixes

This page contains descriptions of the bug fixes in 9.0, consecutive service packs, and emergency releases.

Info!

If you have problems viewing the bug fixes, you can download the full PDF found on this page here.


Version Case ID Internal ID Components Summary
9.0.0.0

XE-8444

Vaadin

Web Desktop

 Unable to Terminate Sessions in Web UI After a Period of Inactivity

Description

When the "Reauthenticate Users After Inactivity" field in mzdesktop is set, sessions in Web UI are not terminated after a period of inactivity.

Resolution

Sessions are revoked after set period of time in "Reauthenticate Users After Inactivity" field in access control.
9.0.0.0

XE-8443

Core

System Log

 Pico Management Not Updating System Log

Description

If Pico config is updated from Web Pico Management UI then system log is not updated.

Resolution

System log is added with proper details for updates.
9.0.0.0

34957

XE-8181

Data Veracity

 Nullpointer Exception Introduced by a Previous Fix

Description

Due to a previous bug fix, an exception is caused due to accessing an uninitialized list.

Resolution

This problem has now be sovled and a check for an empty null value of the list has been added.
9.0.0.0

35090

XE-7962

OpenAPI Profile

 JsonEncodeUdr APL Function Does Not Retain Original Field Name

Description

When encoding UDRs with the JsonEncodeUdr APL function, the UDRs containing field names starting with numbers or symbols are modified to satisfy Java class naming rules.

Resolution

Fix the encoding function to retain the original field name.
9.0.0.0

XE-7923

Documentation

 Missing Documentation for System Tasks

Description

Documentation for many System Tasks is missing.

Resolution

The documentation has now been updated to describe System Tasks.
9.0.0.0

XE-7783

SAP CC

 Wrong Password May Allow SAP CC Workflow to Start

Description

When user insert a wrong SAP CC login password, workflow can be start without abort, no authentication failed message at debug mode.

Resolution

When authentication failed it will immediately showing error and abort the workflow.
9.0.0.0

XE-7763

Netty

 Vulnerability in Netty

Description

A CVE regarding Netty, CVE-2022-41881, was detected.

Resolution

Netty has now been upgraded and this vulnerability is removed.
9.0.0.0

XE-7750

Web Services

 Vulnerability in Apache CXF

Description

Apache CXF contains vulnerabilities ( CVE-2022-46364 and CVE-2022-46363 ).

Resolution

Apache CXF have been upgraded to a non-vulnerable version.
9.0.0.0

XE-7712

MZSH

 Incorrect Handling of Some MZSH Command Failures

Description

Some mzsh commands failures are not reported by the mzsh command line tool. Instead mzsh just silently fails, giving no feedback or error message.

Resolution

This problem has now been fixed and for any exceptions, an explicit message will be displayed.
9.0.0.0

XE-7677

Apache Commons

CVE

 Vulnerability in Commons-Net

Description

Commons-Net contain a vulnerability ( CVE-2021-37533 ).

Resolution

Commons-net have been upgraded to a non-vulnerable version.
9.0.0.0

35051,35291

XE-7663

OpenAPI Profile

 OpenAPI Throws Error When Decoding Array Schema

Description

When using the Http agents with Open API Profile, the agent does not handle requests that contains array schema properly and throws null pointer exception.

Resolution

Fix the agent code to allow handling of array schema. Array schemas will be added to the open api class but will be skipped during decoding.
9.0.0.0

XE-7658

HTTP/2

 Netty Version Upgraded

Description

A security vulnerability has been found in Netty versions 3.10.6.Final and 4.1.15.Final.

Resolution

Netty version is now upgraded to 4.1.73.Final to mitigate the reported vulnerability.
9.0.0.0

XE-7657

Ultra

 bit_block Constructs Not Supported in Switch Statement Prefix

Description

Ultra doesn't support declaring bit_blocks in the prefix of a switched_set.

Resolution

Ultra has been updated to support bit_blocks in the prefix of a switched_set. The fields inside the bit_block can be used as any other field in the prefix.
9.0.0.0

XE-7646

Azure 3pp

 Vulnerability in Azure Libraries

Description

The Azure Libraries package contain a vulnerability ( CVE-2022-31684 ).

Resolution

The Azure Libraries package have been upgraded to a non-vulnerable version.
9.0.0.0

XE-7623

CVE

Postgres

 Vulnerability in Postgres driver

Description

The Postgres driver contain a vulnerability ( CVE-2022-41946 ).

Resolution

The Postgres driver has been upgraded to a non-vulnerable version.
9.0.0.0

34957

XE-7618

Documentation

 Unsupported Data Type for Data Veracity Only Mentioned in the Data Veracity Search Page

Description

We do not support List and Map types for Data Veracity filter, repair and data masking. The documentation only mentions this fact in the Data Veracity search page.

Resolution

The note for unsupported data types for Data Veracity has now been added into the other parts of the documentation for Data Veracity. Namely in the filter, repair and data masking pages.
9.0.0.0

XE-7529

SFTP

 Sort Order Criteria not Always Applied to SFTP Collection Agent

Description

When using the SFTP Collection Agent, the configured Sort Order criteria is not applied to subfolders when the SFTP collection agent setting is as follows: The Include Subfolder option under the Source tab is selected and the Enable Sort Order option under the Sort Order tab is selected and the specified Directory contains only the specified subfolder. The SFTP collection workflow run is expected to abort when the subfolder does not meet the Sort Order criteri. Instead, the workflow runs successfully without any error.

Resolution

This is fixed so that Sort Order criteria is applied when there is only 1 subfolder within the specified directory.
9.0.0.0

XE-7521

CVE

OSGI

 Outdated bndlib Version

Description

Newer versions of bndlib has been released that we should upgrade to.

Resolution

bndlib has now been updated to 6.3.1.
9.0.0.0

34424

XE-7353

Aggregation

Couchbase

 Properties for Couchbase Incorrectly Displayed in Aggregation Agent for Batch Workflows

Description

Despite Couchbase storage not being supported by batch workflows, Couchbase properties are still being displayed when configuring the Aggregation profile.

Resolution

Couchbase properties will not be displayed during configuration unless it is a real-time workflow.
9.0.0.0

30923

XE-7347

Workflow Engine

 Failing to Stop Workflow May Cause the Workflow to Hang in Stopping State

Description

If a workflow stop fails, the workflow state may get into an unrecoverable state. It will then be running and can not be stopped unless the Execution Context is restarted.

Resolution

A workflow stop command will now always attempt to stop the workflow, even if the stop signal has already been sent.
9.0.0.0

XE-7315

Web Desktop

 Vulnerability in WebSwing

Description

WebSwing contains vulnerabilities ( CVE-2022-42920 , CVE-2022-3171 , CVE-2022-42003 and CVE-2022-42004 ).

Resolution

WebSwing has been upgraded to a non-vulnerable version.
9.0.0.0

XE-7228

CVE

Jackson

 Vulnerability in Jackson libraries

Description

The Jackson libraries contain vulnerabilities ( CVE-2022-42003 and CVE-2022-42004 ).

Resolution

Jackson and Jackson-databind have been upgraded to a non-vulnerable version.{color}
9.0.0.0

XE-7100

CVE

Salesforce

 Vulnerability in CometD

Description

The CometD Library contain a vulnerability ( CVE-2022-24721 ).

Resolution

The CometD library have been upgraded to a non-vulnerable version.
9.0.0.0

32937, 488087

XE-6676

Core

Ultra

 udrDecode Leaking Memory Due to ThreadLocal Implementation

Description

When udrDecode or udrEncode is called from the initialize block, certain references held as ThreadLocal values are not be released properly which can cause the system to run out of memory.

Resolution

The references stored as ThreadLocal values are now cleared properly and the system will release memory when the garbage collector is called by the jvm.
9.0.0.0

XE-5976

Documentation

 Missing Explanation on APL and Java Numeric Value Handling

Description

APL and Java handle numeric values in a different manner. Inappropriate value operation can result in an overflow.

Resolution

The relevant documentation has been updated to reflect the differences between Java and APL.
9.0.0.0

XE-5162

System Export/Import

 Unable to import the Statistics Cleaner Workflow Group

Description

The SystemTask.Statistics_Cleaner_grp workflow group is not possible to import.

Resolution

The issue is resolved and the workflow group can now be imported.
9.0.1.0

40753

XE-9652

Documentation

SAP RFC

 Error in SAP RFC Agent Documentation

Description

Incorrect SAP RFC Agent Preparation Documentation

Resolution

The correct information has been added to the Container section of the documentation with the common.java.library.path property.
9.0.1.0

40750

XE-9646

Documentation

 SAP CC Online Agent Documentation Incorrectly Placed and Missing Library

Description

The SAP CC Online Agent Preparations documentation is incorrectly placed in the documentation and the list of libraries is missing _core_admin.jar_.

Resolution

This issue has now been fixed.
9.0.1.0

XE-9640

System Export/Import

 Exception Thrown When Selected Config Has Circular Dependencies in Vaadin System Exporter

Description

In the System Exporter UI, select a config that has circular reference by another config, StackOverflowError exception was thrown.

Resolution

This issue is fixed. Circular dependencies can now selected.
9.0.1.0

40731

XE-9634

Installation

 Incorrect value populate in cell.conf from what had been set in install.xml file

Description

Despite configuring _mz.name_ in the _install.xml_ file, the value doesn’t reflect in the _cell.conf_ file post installation.

Resolution

This issue is fixed. _mz.name_ value should now be populated correctly in _cell.conf_.
9.0.1.0

40176

XE-9596

Pico

Upgrade

 Erroneous Start for EC After Upgrade from MZ8 to MZ9

Description

When upgrading from MZ8 to MZ9, the ECs would start with errors.

Resolution

The issue has been fixed and the ECs start without any error.
9.0.1.0

XE-9575

Data Veracity

Vaadin

 Data Veracity Web UI Filters Failed to Delete and No Helpful Error Message

Description

When user has failed to delete Data Veracity filter, there was error notification, however the error message did not contain any helpful information.

Resolution

When user fail to delete a Data Veracity filter, error notification will now contain useful information for user to troubleshoot further.
9.0.1.0

40176

XE-9557

Documentation

 Upgrade Instructions Not Fully Documented

Description

The upgrade instructions for the Platform Container were not complete.

Resolution

The documentation is now updated under section [https://infozone.atlassian.net/wiki/spaces/MD9/pages/4849779/Upgrade+Platform+Container|https://infozone.atlassian.net/wiki/spaces/MD9/pages/4849779/Upgrade+Platform+Container|smart-link] .
9.0.1.0

40176 40492

XE-9540

Upgrade

 Failed to upgrade to MZ9 when mz.security.user.password.reset.enabled is set

Description

If MZ8.x platform has enabled property mz.security.user.password.reset.enabled, during MZ9 upgrade it failed due to incorrect password state was migrated.

Resolution

This issue is fixed. Platform should be upgraded successfully when mz.security.user.password.reset.enabled is set.
9.0.1.0

40495

XE-9530

Documentation

SAP Hana

 Support for Multi-Version Released 3pp Libraries

Description

3pp libraries using multi-version packaged jars could not be used. This was with the SAP HANA JDBC driver, which made it impossible to use the _Try connection_ button in the Database profile.

Resolution

Multi-version jars, including the SAP HAN JDBC driver, can now be used.
9.0.1.0

40415

XE-9521

REST Agents

 Cannot Save Workflow When REST Client Enables External References

Description

When enabled external reference on REST Client, validation error was thrown even though the reference value are set correctly.

Resolution

This issue is fixed. External reference should now work on REST Client.
9.0.1.0

XE-9447

5G Profile

 5G Profile NRF Behaviour Inconsistent with 3GPP Documentation

Description

When using the 5G profile with http2 agents, there were some inconsistent behaviour relating to the heartbeat timer, custom specification and response handling.

Resolution

We enhanced the 5G Profile and its response handling behaviour when used with the http2 agents to be more in line with details stated in the 3GPP documentation.
9.0.1.0

XE-9433

Conditional Trace

 Disabled UI Buttons in Conditional Trace

Description

Sometimes in the Conditional Trace UI, both the _Start_ and _Stop_ buttons may be disabled.

Resolution

The issue has now been corrected so that the _Start_ and _Stop_ buttons are always enabled depending on whether a trace is running.
9.0.1.0

XE-9432

Conditional Trace

 Conditional Trace UI Parameters Not Displayed

Description

Conditional Trace UI may not correctly update the displayed parameters for the selected Trace Template.

Resolution

The issue has been fixed.
9.0.1.0

XE-9431

Core

 Deserialization of UDRs May Result in a ClassCastException

Description

When stored UDRs from earlier versions of MediationZone are deserialized, you may get a ClassCast Exception.

Resolution

This problem has now been fixed and deserialization should work as intended.
9.0.1.0

40176

XE-9419

Access control

Upgrade

 Upgrade Failed Due To Platform Failing to Move auth.properties File Into mzdb

Description

During the upgrade from mz8.3 to mz9.0.0.0, _auth.properties_ failed to update into _mzdb_ if the table is empty.

Resolution

Add a checking if the table is empty skip the update, and proceed to insert into _mzdb_.
9.0.1.0

40176

XE-9417

Documentation

Installation

 Missing Information About Desktop In Post Upgrade Instructions

Description

The information about how to install the desktop or legacy desktop once the upgrade is done was missing from the documentation.

Resolution

The Post Upgrade section of the documentation is now updated with the relevant links.
9.0.1.0

XE-9400

Desktop Launcher

 Legacy Desktop Launcher Issue with OpenJDK 17

Description

Legacy desktop launcher will not work with OpenJDK 17.

Resolution

This issue is fixed. Legacy desktop launcher is now compatible with the most recent JDK version.
9.0.1.0

40176

XE-9385

Upgrade

 Upgrade MZ8 to MZ9 fails when system insight is enabled

Description

If system insight is enabled in the MZ 8.x installation by the property “mz.system.insight” being set, then upgrade to MZ 9.0 will fail. The system will not start up since the system insight packages are no longer available.

Resolution

The issue has now been fixed and the property will have no effect in the MZ 9 system after upgrade.
9.0.1.0

XE-9368

SAP RFC

 Deadlock in SAP JCO RFC Agent When Stopping the Workflow

Description

Deadlock occurs in the SAP JCO RFC agent when the user stops the workflow whenever the UDR queue is full of UDRs.

Resolution

Removed lengthy loop logic waiting for the UDR queue to become empty when the user stops the workflow. Removed lengthy loop logic waiting for the RFCExecutor Thread to complete when the user stops the workflow. Added a try-catch handler for InteruptedException to exit the RFCExecutor Thread when the user stops the workflow
9.0.1.0

XE-9332

Documentation

Upgrade

 Updating Upgrades Document on Database Properties Settings

Description

Missing information on database related settings in the Upgrade Preparations document.

Resolution

The missing information is now updated in the document.
9.0.1.0

XE-9328

MZSH

 MZSH Commands Accessible Without Login

Description

In previous versions of MediationZone, some administrative commands were exposed to all users. This could potentially lead an unauthorized user to obtain information about the system.

Resolution

The verification of access rights has been fixed and sensitive commands are exposed only to authorized users as per design. Additionally, the interactive mode has been removed from mzsh.
9.0.1.0

XE-9325

Diameter

 Excessive logging from Diameter

Description

When receiving answers of timed out requests, the Diameter stack log one line for ever message. This can cause very excessive logging in some situations which can impact performance.

Resolution

When there many log messages like this, the logging is now throttled to a reasonable level
9.0.1.0

XE-9279

OpenAPI Profile

 HTTP2 Server Agent Unable to Set UDRs with Read-Only Fields

Description

When UDRs are generated from the Open API schema specification file, certain UDR fields used in the response body are marked as read-only. In some cases, the HTTP2 Server agent needs to initialize and set those fields to generate a proper response.

Resolution

Added a checkbox in the Open API profile to allow users to have the option to ignore the read-only tag for the selected schema specification file.
9.0.1.0

XE-9259

System Export/Import

 Vaadin System Exporter Memory Leak Issue

Description

Navigating system exporter back and forth cause UI pico out of memory when the system has a lot of configurations.

Resolution

System exporter memory leak issue has been fixed.
9.0.1.0

XE-9250

Core

 Encoder Cannot Handle Large Amounts of Data

Description

When running really large UDR through a workflow, the Encoder may not have capacity enough and throw an error.

Resolution

The Encoder has now been redesigned to allow larger UDRs and the the problem with processing large amounts of data is fixed.
9.0.1.0

XE-9186

JMS

 JMS Collector Agent Optional Field Issue

Description

The Subscription Client ID for the JMS Collector agent will fail the workflow validation although the field is optional as mentioned in the documentation.

Resolution

The Subscription Client ID Field is removed from the validation list.
9.0.1.0

XE-9116

SQL agents

 SQL Forwarder Configuration Import Issues

Description

Specific fields or configuration save states are lost when importing the SQL forwarder from MediationZone 8.x to MediationZone 9.x.

Resolution

Added logic to handle imports from MZ 8.x to MZ 9.x.
9.0.1.0

XE-8979

5G Profile

 Open API Profile Config Import Issues

Description

Certain fields or config save state is lost when importing the Open API Profile from MZ 8.x to MZ 9.x

Resolution

Add logic to handle imports from MZ 8.x to MZ 9.x
9.0.1.0

XE-8794

DynamicWorkflow

 Exception Thrown When Editing Workflows

Description

When editing a workflow using Workflow Editor, an exception can be thrown.

Resolution

The issue has been fixed.
9.0.1.0

40160

XE-8495

Database Agents

 Upgrade Oracle Deprecated Methods

Description

The database forwarding agent was using two obsolete methods for Oracle's batch update functions. This causes performance issues when running toward Oracle 19c.

Resolution

The function calls have now been updated to no longer use deprecated implementations of the JDBC driver.
9.0.1.0

XE-8276

Data Veracity

Vaadin

 Unsupported Data Types are Selectable in Data Veracity UDR Browser

Description

Unsupported data types like Map and List are selectable in Data Veracity Restricted Field Edit/New dialog.

Resolution

Unsupported data types are hidden from a user in Data Veracity Restricted Field Edit/New dialog.
9.0.1.0

XE-8269

Data Veracity

Vaadin

 Unable to Use Save or Save As on Data Veracity Search UI

Description

The existing Data Veracity Search page has no option for Save New and Update. Users can only load a saved filter and modify the queries.

Resolution

This has been fixed by adding two new options added to Save, namely Save New and Update, allowing the user to save as new or update existing.
9.0.1.0

XE-8211

5G Profile

 Incompatible 5G Profile and Workflow Instance Table Exported from MZ8

Description

5G Profile and workflows exported from MediationZone 8 not compatible with Private Edition and MediationZone 9. Some fields in the 5G Profile and workflow instance table columns have gone missing when imported into PE and MZ9.

Resolution

Some fields in the 5G Profile and some fields in the workflow instance table column exported from MZ8 are given special handling when being imported into PE and MZ9.
9.0.1.0

33327

XE-6862

Core

 Issue With Long Workflow Package Names

Description

Sometimes workflow packages with long names would exceed the DB column limit of 64 characters for the workflow key. This would break the workflow handling.

Resolution

This issue has been fixed by adding a character limit check to workflow packages. Validation has been added to the export of workflow packages to prevent this from happening. A (dynamic) limit has been added to the workflow package name. This limit is dynamic and not a “hard” limit because the key itself is comprised of other dynamic parts besides the workflow package name, such as version, system name, and instance ID.
9.0.1.0

40036

XE-8829

Documentation

 Documentation Update on Keystore Creation

Description

The references to “mzsh keytool” are no longer valid.

Resolution

Documentation has been updated to replace these references with valid information on creating Keystore.
9.0.1.0

40731

XE-9633

Installation

 Broken Link to Legacy Desktop Documentation

Description

The link to the Legacy Desktop section in the user documentation is broken.

Resolution

The link has now been fixed and points to the right place.
9.0.1.0

XE-9296

Documentation

 Web Desktop Installation Documentation Incomplete

Description

Web Desktop installation documentation had instances of service context and some extraneous information.

Resolution

The documentation is now updated accordingly.
9.0.3.0

45097

XE-13918

Upgrade

 Workflows That Use the HTTPD Agent with Keystore Settings are Deleted

Description

Workflow tables that references HTTPD’s keystore and truststore fields disappear after upgrading from MZ8. After upgrading from MediationZone 8, workflow tables that reference HTTPD’s keystore and trustore fields disappear. After upgrading from MZ8, workflow tables that reference HTTPD's keystore and truststore fields disappear.

Resolution

The keystore and trustore fields for HTTPD no longer exist, as MediationZone 9 uses Security Profile instead. A note is added to the HTTPD documentation to inform users on this issue.
9.0.3.0

XE-13835

Core

 CVE-2021-47621 in Classgraph Library

Description

The CVE-2021-47621 is present in classgraph library.

Resolution

This CVE is resolved by upgrading the classgraph library.
9.0.3.0

45016

XE-13713

Upgrade

 Configuration Migration Fails for Some Workflows During Upgrade MZ8 to MZ9

Description

When upgrading from MZ8 to MZ9, some workflow configuration may fail during the migration.

Resolution

Fixed vcimport issue when there are no matching parameters found in workflow table column and the issue where the migration of configuration from MZ8 might overwrite existing configurations.
9.0.3.0

44999

XE-13710

Ultra

 Global Or Named Attributes Support In Ultra XML

Description

We didn't support global named attributes before. If the user tried to define such an attribute a parsing exception was thrown.

Resolution

Global named attributes, or named attributes at the root level are now supported and can be used from other non root attributes with the ref argument.
9.0.3.0

44851

XE-13684

REST

 REST Agent ResourceURI In Response Populated With Inaccurate Value

Description

ResourceURI in the response message will be populated with a value that is a combination of the path from BaseURL and the actual ResourceURI from the request message.

Resolution

Fix to ensure the ResourceURI in the response message matched the ResourceURI from the request message.
9.0.3.0

44724

XE-13500

Core

 Workflow Validation Can Be Very Slow For Dynamic Fields

Description

For a Workflow Configuration using Dynamic Fields, validation can become extremely slow if you have many rows in the workflow table. This is due to failures in field type lookup causes a large amount of synchronous requests being sent from the UI process to the platform.

Resolution

The issue has been fixed and the unnecessary lookup attempts have been eliminated.
9.0.3.0

No salesforce ID.

XE-13490

Documentation

 Missing Appendix For Changing Java Versions In Installation Instructions

Description

An appendix containing information on changing Java versions was missing in the Installation Instructions documentation.

Resolution

The appendix has been added back into the Installation Instructions.
9.0.3.0

XE-13489

Core

 Vulnerabilities Found in Bouncycastle

Description

BouncyCastle versions prior to 1.78.1 could be susceptible to various vulnerabilities including, side-channel attacks, timing-attacks, affecting specific cryptographic algorithms.

Resolution

BouncyCastle has been updated to 1.78.1 to mitigate these vulnerabilities.
9.0.3.0

44706

XE-13417

Documentation

System Insight

 Missing Information on How to Set Up Prometheus for System Insight in MediationZone 9 Documentation

Description

Prometheus backend is now replacing InfluxDB in System Insight. Users are looking for information on setting up Prometheus in MediationZone 9, but there is no available documentation.

Resolution

The user documentation has been updated to include the necessary details for setting up Prometheus in MediationZone 9.
9.0.3.0

44620

XE-13307

Realtime Batch

 RealTime Batch Disk Forwarding Agent Missing Data

Description

When forwarding more than 1000 UDRs with Disk Forwarding, some are lost in the process.

Resolution

This issue has now been fixed and the user can now send more than 1000 UDRs without losses.
9.0.3.0

44626

XE-13305

VCFormat

 “vcexport” Command Does Not Support Encryption Profile

Description

Neither vcexport nor vcimport commands support the Encryption Profile configuration type. There is no defined file extension for this configuration type.

Resolution

To resolve this issue, define a file extension for this configuration type.
9.0.3.0

44401

XE-13214

Workflow Engine

 Queue Throughput Reported in System Statistics Is Higher Than Actual Throughput

Description

Due to rounding errors in the Queue Throughput calculations, the value is misreported as too large in System Statistics.

Resolution

The calculation has been fixed to be as exact as possible (given that it is reported as an integer value).
9.0.3.0

44418

XE-13199

REST

 "Error Message: Request too large" is Encountered when Rest Response has Exceeded 8MB

Description

When the REST response has exceeded 8MB, users will encounter “Error Message: Request too large: Request of size <size> was longer than the maximum of 8388608”. This is caused by the new limit added to the third-party library in order to limit the memory usage.

Resolution

A new property, the "rest.client.max.strict.bytes" is added to allow users to adjust the maximum number of bytes when reading the entire entity into the memory.
9.0.3.0

44432

XE-13146

MZ Installation

 Non-default "install.admin.password" Value is Ignored During Installation

Description

During an installation, any non-default value provided for “install.admin.password” property will be disregarded when “install.security” is set to false. This result in the default admin password being configured as the default value.

Resolution

This issue is resolved by allowing the non-default value for “install.admin.password” property to be used as the admin password during an installation regardless of the “install.security” property value.
9.0.3.0

44400

XE-12953

HTTP APL Functions

 HTTP Client Functions May Crash EC When Timeout and Response are Received Simultaneously

Description

HTTP Client Functions may crash an EC when a timeout and Response are received simultaneously.

Resolution

Deprecated thread stopping functions are refactored to respond with timeout without crashing the EC.
9.0.3.0

44394, 44157

XE-12946

OpenAPI Profile

 OpenAPI Profile Does Not Typecast Number to BigDecimal

Description

The OpenAPI profile does not typecast numbers to BigDecimals.

Resolution

This issue is resolved and when the type is “number” without a defined format, any numbers should be allowed. The number encompasses both integer and floating-point numbers (BigDecimal).
9.0.3.0

44159

XE-12914

MZSH

 Incorrect Documentation for MZSH and Configuration Spaces

Description

The documentation contains incorrect information about using standard input with mzsh as well as references to configuration spaces which no longer exist.

Resolution

The documentation has now been updated.
9.0.3.0

44298

XE-12901

REST

 REST Client Agent with HTTPS Base URL Sending Requests to the HTTP

Description

The Rest Client Agent sends the request to the HTTP endpoint despite configuring the Base URL with HTTPS.

Resolution

This has been fixed to ensure the request is sent to HTTPS when the endpoint is configured to use HTTPS.
9.0.3.0

44190

XE-12883

Workflow UI

 Legacy Desktop Incorrect External Reference Cell Value When Editing A Column After Sorting The Workflow Table Name Column

Description

This issue only happens in Legacy Desktop Workflow Editor. When sorting the Name column in the Workflow Table, on double-clicking an external reference cell at another column to edit, a random external reference name of another cell is displayed instead. If no change is done, the cell will now be set to the incorrect random external reference name.

Resolution

The issue is fixed and the correct external reference name will remain when clicking to edit.
9.0.3.0

33937

XE-12874

Documentation

Dup Batch

 Unclear Documentation for Dup Batch Detection on MIMs

Description

When reading the documentation for the Dup Batch profile, it is not entirely clear how empty batches will be evaluated when using MIM values as detection method.

Resolution

The documentation has now been updated to clarify this a bit more.
9.0.3.0

XE-12714

Jetty

 Vulnerability Found in org.eclipse.jetty (9.4.49.v20220914)

Description

An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. Solution Update the version of org.eclipse.jetty from 9.4.49.v20220914 to 9.4.54.v20240208.

Resolution

9.0.3.0

44151

XE-12687

Upgrade

 Upgrade Failed Due to Limited Field Size in platform_properties Table

Description

The current length for the field prop_value in platform_properties table was too small, and this caused some upgrades to fail.

Resolution

The field length has been increased from 64 to 256 characters.
9.0.3.0

XE-12685

Postgres Database

 Vulnerability For PostgreSQL Extended Mode In Connection Property

Description

A vulnerability exists when using the extended mode in the connection property. This only impact customers who would use the advanced options, and does not impact customers using the default, and simple mode in connection property. Solution: PostgreSQL has been updated to 42.7.3 to mitigate this vulnerability.

Resolution

9.0.3.0

44041

XE-12622

Security Profile

 Unable to Import Security Profile with External Referenced Keystore Path

Description

Importing a Security Profile with an external referenced Keystore Path causes an import error, due to the value being identified as empty.

Resolution

The issue has been fixed and it is now able to import a Security Profile with an external referenced Keystore Path.
9.0.3.0

XE-12620

SFTP

 Configurations with SFTP Agents Cannot be Imported

Description

Configurations with SFTP agents exported from version 8.3.3.x cannot be imported to version 9.x.

Resolution

This problem has now been fixed and configurations with SFTP agents can be imported as expected.
9.0.3.0

44006

XE-12587

Web API

 Server Processes Accept HTTP TRACE Calls

Description

The built-in webservers on our server processes accept HTTP TRACE calls. For security reasons, this should not be allowed. This affects the platform, Desktop Online, as well as any Execution Context processes.

Resolution

We are now blocking TRACE and TRACK explicitly, giving a 403 Forbidden response.
9.0.3.0

43774

XE-12513

Aggregation

Ultra

 Aggregation Agent Causes Workflow Abort After Upgrade

Description

Workflows containing an Aggregation agent may abort after upgrading from version 8.3 to 9 if the session contains date or UDR data.

Resolution

This issue has now been fixed, and the old session data from version 8 is readable, and the workflow no longer aborts after an upgrade.
9.0.3.0

43670

XE-12291

Aggregation Inspector

Documentation

 Aggregation Session Inspector Availability not Documented

Description

The Aggregation Session Inspector is only available in the Desktop interface, which is not obvious to the users and needs to be documented.

Resolution

This is now described in the user documentation.
9.0.3.0

43674

XE-12287

Radius

 Secret Key for Radius Visible in Plain Text

Description

When configuring a secret key for the Radius agent, it is visible in plain text both in the agent configuration and in the workflow table.

Resolution

This problem has now been fixed and the secret key is not visible in plain text anymore.
9.0.3.0

XE-12143

Core

Ultra

 Vulnerability Detected in Clojure

Description

A vulnerability was detected in the version of Clojure used.

Resolution

This has now been fixed by upgrading Clojure.
9.0.3.0

43435

XE-11953

HTTP/2

 HTTP2 Agent Receives Invalid Request Due To Sending Multiple Credentials

Description

The HTTP2 Agent will receive an invalid request response when sending a request with multiple credentials, one in the header and one in the request body.

Resolution

Add a check to remove the credentials from the request body if it already exists in the headers.
9.0.3.0

XE-11935

AWS

 CVE Caused by Outdated ion-java Package

Description

Outdated ion-java package causing high CVE.

Resolution

Upgrade to use ion-java version 1.11.0.
9.0.3.0

43158

XE-11885

Database Profile

 Connection Leak in Database Forwarding Agent and sqlExec APL Function After DB Profile is Updated

Description

After the property “postgresql.connectionpool.maxlimit” in the Database Profile is updated, the old connections in the connection pool are not properly removed. This leads to a connection leak in Database Forwarding Agent and sqlExec APL function.

Resolution

This issue has been fixed for Database Forwarding Agent and sqlExec APL function.
9.0.3.0

XE-11882

Aggregation Inspector

  Aggregation Session Inspector Does not Release Profile Lock

Description

In Aggregation Session Inspector vaadin UI, exiting from Explore Session using ESC button did not release the profile lock.

Resolution

Add profile lock release process upon exiting Explore Session with ESC button.
9.0.3.0

42763

XE-11874

SAP CC

  Transactional Behavior Broken for SAPCC Batch Agent

Description

The transactional behavior is not working for the SAP CC batch agent if a workflow is stopped immediately. The worklfow is likely to abort and the transaction state of the SAP CC batch agent will not be saved. This will result in the agent not sending the last processed UDR.

Resolution

The transaction state is now saved properly, the agent will now function as expected.
9.0.3.0

XE-11665

Core

 Upgrade SFTP Library to Remove CVE-2023-48795

Description

The existing SFTP third-party library Maverick 1.7.53 contains CVE-2023-48795, which is vulnerable to security issues.

Resolution

Upgrading to the latest Maverick 1.7.56 has fixed the issue.
9.0.3.0

43172

XE-11596

Alarms

 Host Statistics and Pico Alarm Condition Missing

Description

The Host Statistics and Pico Instance Alarm conditions are not available.

Resolution

This functionality has now been added and they are showing in Alarm Detection Profile.
9.0.3.0

XE-11594

DataHub

 DataHub with Kerberos Authentication Fails

Description

Datahub workflow with LDAP authentication or None authentication aborted with failed to copy to temp HDFS file exception whenever Datahub workflow with Kerberos authentication was run before them.

Resolution

This problem has now been solved and you can set this flag ipc.client.fallback-to-simple-auth-allowed to true.
9.0.3.0

XE-11588

Hadoop

 Vulnerability CVE-2023-2976 in MediationZone

Description

Vulnerability CVE-2023-2976 is detected.

Resolution

Vulnerability CVE-2023-2976 is resolved.
9.0.3.0

XE-11587

Hadoop

 CVE-2022-3509 in protobuf Library

Description

The CVE-2022-3509 is present in protobuf library.

Resolution

The protobuf library has been removed, so that the CVE-2022-3509 is solved.
9.0.3.0

XE-11585

Avro

 Avro Vulnerability CVE-2023-39410

Description

The Avro library included with the Ultra Avro support package is impacted by the vulnerability CVE-2023-39410. This could allow for Denial of Service attacks by manipulating the input data.

Resolution

Avro has been upgraded.
9.0.3.0

XE-11486

Ultra

  Compilation Error with Nested Objects In Avro

Description

When having an Ultra format containing Avro schema with nested complex object definitions, you may get a compilation error.

Resolution

The code generation implementation has now been fixed to generate unique class names.
9.0.3.0

00042894

XE-11407

Prometheus

 Unable To Rename Prometheus Forwarding Agent From Desktop

Description

Desktop does not allow the Prometheus forwarding agent renaming as there was no way to enable it to happen. Renaming of the agent from the Legacy Desktop is still allowed.

Resolution

An interface has now been added to the Prometheus Forwarding agent to enable users to rename it from the Desktop.
9.0.3.0

00042786

XE-11362

Database Profile

 Database Profile Interface Improvement

Description

Database Profile UI does not prompt notification to save configuration after changes to the External Reference and Advanced Properties. It also does not retain values when the tabs/radio button is toggled. There is an unused field - "Notification Service", in the External Reference table, which is meant only for Oracle DB.

Resolution

Improved the UI to prompt users to save the configuration when changes are made, retain values when the tabs/radio button is toggled, and the "Notification Service" field has been removed from the External Reference table for database types that do not require this field.
9.0.3.0

42737

XE-11333

Vaadin

 Realtime Workflow not Importing as Standalone Execution Type

Description

When ExecutionSettingsPanel is created for display on the screen, initially it does not set the Workflow Execution Type with the persisted configuration data and it defaults to Normal. For the Desktop UI, after the creation of ExecutionSettingsPanel, it will call the setStandAlone method to set the Workflow Execution Type based on the persisted configuration data. In the Desktop interface, it never performs the second step to set the Workflow Execution Type with the retrieved persisted configuration data. Therefore, the correct persisted configuration data for the Workflow Execution Type is not reflected on the Desktop.

Resolution

For the Desktop interface, we need to call the setStandAlone method after the creation of ExecutionSettingsPane. Then the persisted configuration data for Workflow Execution Type is reflected on the screen.
9.0.3.0

43121

XE-11323

Upgrade

 Mzsh topo Command Not Working After Upgrade From 10.8.6 to 9.1

Description

The mzsh topo command does not work as intended when upgrading from an older version of 10 to 9.1. This issue is caused by the missing topo migration handling.

Resolution

This issue is fixed and the topo command is now working as intended.
9.0.3.0

XE-11321

AMQP

 Vulnerability in the amqp-client used by the AMQP Agent

Description

A vulnerability was detected in the amqp-client library.

Resolution

The amqp-client library has now been upgraded to remove this vulnerability.
9.0.3.0

42776, 43004

XE-11310

ECS

 ECS APL Functions Missing

Description

ECS APL functions such as udrAddError() and udrGetErrorMessages() are not available.

Resolution

This problem has now been fixed and the ECS APL functions are available.
9.0.3.0

42670

XE-11202

OpenAPI Profile

 HTTP2 Client Agent Decodes Response with No Content

Description

The HTTP2 Client Agent decodes the response body received to populate the OpenAPIUDR object, including responses with status code 204 No Content. Since responses with status code 204 do not have any body content, errors are listed in the EC log, and performance is slowed down.

Resolution

This issue is fixed, and if the response has status code 204, there will be no attempt to decode the response body.
9.0.3.0

00042631

XE-11145

Pico

 Distributed Storage Does Not Declare Dependencies

Description

The Distributed Storage package does not properly declare its dependencies. That means that depending on the license, those dependencies may not be enabled and the functions will abort in runtime.

Resolution

The dependency declaration has been fixed
9.0.3.0

41984

XE-11109

Swing Desktop

 Expand/Collapse All in Desktop

Description

Expand/Collapse All buttons are not available.

Resolution

Expand/Collapse All buttons have now been added.
9.0.3.0

XE-11079

Google Cloud Storage

 Vulnerability Detected in BigQuery Storage Client Library

Description

Security Upgrade for BigQuery Storage API Client Library

Resolution

grpc-google-cloud-bigquerystorage-v1beta1 client library has been upgraded to address the security vulnerability identified in CVE-2023-44487.
9.0.3.0

XE-10979

MZ Installation

 Duplicate JDBC properties in install.xml File

Description

The install.xml file contains duplicate JDBC properties, and this cause issues for users to update the values during upgrade process. These duplicate properties are mz.jdbc.user , install.db.jdbc.user , install.<DB_TYPE>.jdbc.user , and mz.jdbc.password , install.db.jdbc.password , install.<DB_TYPE>.jdbc.password .

Resolution

The duplicate properties are removed and only mz.jdbc.user and mz.jdbc.password are retained.
9.0.3.0

39011, 40350, 41464

XE-10946

SAP CC

 SAP CC notification TLS is not working

Description

SAP CC notification TLS is not working due to a bug in SAP CC library API that is used by the SAP Notification Agent.

Resolution

SAP has provided a fix that as of writing is only available for SAP CC version 2020 SP2 Patch 5 and SAP CC version 2023 FPS1. A code fix is required and is done for SAP Notification Agent to implement the fix from SAP which resolved the SAP CC notification TLS issue. Expecting more SAP CC versions to get this fix moving forward, you can check with SAP on availability of this feature for other SAP CC version.
9.0.3.0

XE-10848

OpenAPI Profile

 NullPointerException Occurs During Validation of OpenAPI Profile

Description

NullPointerException occurs when the user validates the OpenAPI profile with a yaml file that has empty properties in Object Schema.

Resolution

A check is now done to see if the properties are null before proceeding to validate any Object Schema in the yaml file.
9.0.3.0

XE-10818

HTTP/2

 Disabling RouteToAPL On HTTP2 Server Agents Causes Error Messages To Be Dropped

Description

When the routeToAPL checkbox is disabled in the HTTP2 Server agent, certain errors and the error messages encountered by the HTTP2 Server agent backend logic are not sent back to the client agent as a response.

Resolution

The HTTP2 Server agent backend behavior has not been adjusted to account for scenarios with routeToAPL disabled.
9.0.3.0

XE-10631

Documentation

 Missing Instruction to Read the License File

Description

There is no instruction to guide users to retrieve the mz.license file content.

Resolution

The documentation is updated with the required command to retrieve the content in mz.license file.
9.0.3.0

XE-10566

Streaming Telemetry

 None

Description

Resolution

9.0.3.0

XE-10563

SAP RFC Profile

 RFC Agent Aborts on Faulty Server Results

Description

The RFC templates are queried from the server and cached locally when connecting to RFC. However, sometimes during the initialisation, the RFC server may return a null value for a template. These null values would cause the workflow to abort.

Resolution

Null values are now detected when the server is queried, and the user can re-try a number of times before aborting the workflow if the template is not found.
9.0.3.0

XE-10543

HTTP/2

OpenAPI Profile

 HTTP2 Server Agent Routes Errors Back To Analysis Agent Incorrectly

Description

When using the HTTP2 Agent with the Analysis Agent, if an improper response is constructed in the Analysis Agent and passed to the server agent, it is still routed back to the Analysis Agent even when the routeToAPL checkbox is disabled.

Resolution

The HTTP2 Server agent backend behavior has now been adjusted to directly send the response back to the client agent in the scenario where the response is constructed improperly and routeToAPL is disabled.
9.0.3.0

42020

XE-10536

Rebranding

 Product Version Hardcoded to 9.0

Description

The product version was hardcoded to 9.0.

Resolution

The hardcoded value has been replaced with a dynamic version number that updates according to the deployment version.
9.0.3.0

XE-10534

DataHub

 Datahub Aborts When Trying to Connect to Cloudera

Description

DataHub workflow aborted when trying to connect Cloudera deployed in AWS EC2. This is because datahub workflow was contacting the external network outside of our office network using IP address by default. IP address translation between local area network and external network blocks communication of datanode internally.

Resolution

Enable datanode communication to use hostname instead of IP address. Set this flag dfs.client.use.datanode.hostname to true.
9.0.3.0

XE-9386

Upgrade

 Unnecessary Properties in install.xml File

Description

The install.xml file contains unused properties, and this cause issues for users to update the values during the upgrade. These properties values do not automatically update from the existing installation.

Resolution

The install.xml file has been clean up and most of the properties are now able to be updated automatically from the existing MZ_HOME.
9.0.3.0

XE-5393

Ultra

 schemaLocation Usage in Ultra XML Definition

Description

Currently, targetNameSpace property is always added to target locations. In case targetNameSpace is null, then schemaLocation is completely ignored.

Resolution

A new system property called mz.ultra.xml.schemalocation.newparsing is added. If set to true, it will give precedence to schemaLocation (if available) and targetNameSpace will be ignored. In case property is not available (or set to false), then the default behaviour is backward compatible.