WHD 12.8.4 Is out, start your testing!

I have this loaded in a two different test environments and can confirm that at least the character combo crashes, checklist errors and tomcat versions have been addressed.

Report back with your findings!

Top Replies

pabely 1 month ago in reply to JGrant24 +1

As you came form 12.8.3+HF2 you may have missed this in HF3 which would apply to 12.8.4 as well. Resolved issue with JVM argument to allow users to opt out of IP binding enforcement. Note: This fix is…
pabely 1 month ago in reply to JGrant24 +1

I am pleased this worked for you, easy to miss as it is only in the 12.8.3+HF3 release notes and has not made it into the 12.8.4 Admin Guide yet as per other wrapper switches - I have already brought this…
PeterB-IPS 1 month ago +1

New License auto-activating daily, bogus notifications in messages??? (Since v12.8.4 upgrade installed.) Our upgrade to v12.8.4 seems to be fine, but I do notice the Lic appearing to auto-activating…

govitallen 1 month ago

Was there a vulnerability in the Tomcat version?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel

james.kluza 1 month ago in reply to govitallen

https://nvd.nist.gov/vuln/detail/CVE-2024-52316

https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928

From the Release notes:

CVE-2024-52316

Unchecked Error Condition vulnerability in Apache Tomcat

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

9.8 Critical

The severity is a bit misleading as Apache shows this is low and github and others are classifying as critical.

govitallen 1 month ago in reply to james.kluza

Thanks for the info. It looks like we won't be affected if we don't use Jakarta Authentication then?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
james.kluza 1 month ago

I take that back. 'java.com' will still crash the ticket/session, even if you wrap it in a quote or code block.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
JGrant24 1 month ago

Are you getting any CSRF errors with 12.8.4? I'm hoping they resolved this issue in this version.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
pabely 1 month ago in reply to JGrant24

Yes mine Lab seems to be clean with those now but plenty of "ERROR w.helpdesk.com.macsdesign.whd.daemon - Error while triggering session in com.macsdesign.whd.daemon.ServletPulseDaemon: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" still !!
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
JGrant24 1 month ago in reply to pabely

Hmmm... any system crashes or just errors showing in the logs?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
pabely 1 month ago in reply to JGrant24

No crashes so far, upgraded about 6 hours ago and been pumping various test scenarios through. Errors just being reported in logs just a frequently as the CSRF errors used to show.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
JGrant24 1 month ago in reply to pabely

Sounds promising! With 12.8.3 HF2(currently) if too many CSRF error happened our system was just hang. Solarwinds don't think that was the issue but that was the only correlation. No CSRF erros no hang lol. The errors would just happen randomly and didn't have this issue with any other version. Welp... Guess I'll give this a shot tonight. Fingers cross everything stay working!
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
james.kluza 1 month ago in reply to james.kluza

ticket 01819046 opened for this continued character issue.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel