Overview

  • The bundled AdoptOpenJDK 11 was updated to version 11.0.12
  • Java 17 supported
  • Update of old versions is now limited. If you are using an unsupported old version, an update to an intermediate version is required
  • It is allowed to create a Let's Encrypt certificate with a callback to the HTTPS port. Problems with redirect to HTTPS and if the server runs only on HTTPS are solved
  • Added QR code to the error page, linking to a help page which may have further details
  • Different ports, configured in the configuration Web Server dialog, use different HTTP sessions
  • An error message occurred during setup if redirect to HTTPS is enabled
  • The plugins dialog in the configuration of the server was replaced by the Plugin Store
  • Memory management for systems with a large heap (>= 4 GB) was improved
  • The version number of plugins now consists of 3 parts
  • The plugin "Web Server Defender" added to protects against DoS and account hacking using brute force
  • The cookie attribute "SameSite" can now be set. The default value is Lax
  • Search bar and ticket views now also support an OR search with the keywords "or", "||" and "|"
  • Embedded web pages now also supports the linking (redirect) of web pages. Additional rights management based on "users and groups" memberships
  • Internet Explorer and the "old" Edge browser (not Chromium) are no longer supported

Security

  • Security Update for CVE-2021-29425
    • In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value
  • Security Update for CVE-2021-28165
    • In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame
  • Security Update for CVE-2021-28169
    • For Eclipse Jetty versions ⇐ 9.4.40, ⇐ 10.0.2, ⇐ 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application
  • Security Update for CVE-2021-34428
    • For Eclipse Jetty versions ⇐ 9.4.40, ⇐ 10.0.2, ⇐ 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
  • Security Update for CVE-2021-21409
    • Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final
  • Security Update for CVE-2021-31812
    • In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions
  • Security Update for CVE-2021-36090
    • When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package
  • Security Update for CVE-2021-35517
    • When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package
  • Security Update for CVE-2021-37714
    • jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes
  • Jetty version updated because of:
    • CVE-2020-27216
      • In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability
    • CVE-2020-13956
      • Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution
    • CVE-2020-27218
      • In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request
    • CVE-2020-27223
      • In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values
  • Guava version updated to 30.1 because of CVE-2020-8908
    • A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured
  • Cron-utils updated to version 9.1.3 because of ​https://nvd.nist.gov/vuln/detail/CVE-2020-26238
  • Security Update for CVE-2020-1967
    • Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)
  • Security Update for CVE-2021-20328
    • Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption

Authentication

  • Plugin "Token Authentication" added. Enables Web API access using access tokens. It allows users to create access token as another means of authentication into their account - but with restricted access scopes
  • Support added for HMAC token authentication like used from MS Teams

New Features / Improvements

  • Generic OpenID Connect (OIDC) authentication provider added
  • Azure OpenID Connect (OIDC) authentication provider added

Fixed Bugs

  • OAuth authentication (Azure) with Safari browser was not possible
  • Permission check for the WebAPI has not worked in connection with the default Windows Authentication
  • URL was wrong after signup with any OAuth authentication provider like Azure and if a reverse proxy (like default.aspx for IIS) was used

Help pages

  • PDF export from a help page was not possible if the browser access occur via a not trusted HTTPS URL

Maintenance

  • Problems with backup of large files from a database persistence (MongoDB, AzureCosmosDB) occurred

Statistics

  • The number of entries for each message in the event log is reduced

Plugins

Discord

  • Discord plugin in category "Task Planner" will be replaced by general Discord plugin. You can find it in Plugin Store category "Communication". If the old plugin was activated, the new one will be installed automatically by the setup

Multiple Columns

  • Fixed: Rotated text is not compared when using the multi column filter

Plugins

Notifications

  • Permanent notifications must be kept in the notification center, even though they are displayed by the operating system

OCR Tesseract

  • Unnecessary dependencies removed
  • update the tess4j version to 4.6.0

Plugins

Store

  • The store is new and replaces the configuration of the plugins in the configuration
  • New versions and features are requested from the public plugin store and can be installed
  • On future updates, the setup will automatically update all activated plugins from the store
  • Fix for reading plugin changelogs (2021-12-27)

i-net PDFC Core

  • Whitespace calculation for small fonts improved
  • Footer position corrected in case the header is missing.
  • A font difference will now be detected in case the design font name is the same, but the actually used font differs due to a missing embedded font

Plugins

Remote GUI

  • Fixed CVE-2021-43962 - possible XSS vulnerability of RequestPage parameter
  • Fixed data buffer length for ajax and websocket requests
  • Corrected timeout handling for websocket connections with broken VPN connections
  • Moved file service check to temp folder instead of working directory

i-net PDFC Server

  • Set a custom product title for external representation

Plugins

Statistics

  • Date and time values now respect the client's time zone when displayed
  • Memory for user and reports now store 20,000 entries as maximum to limit memory consumption

Plugins

Task Planner

  • Long running tasks were sometimes displayed as 'INCOMPLETE'
  • Correction of identical file names in the file actions for multiple identical jobs with parameter placeholders in one task.

Plugins

Users and Groups

  • Per URL parameter "s" search phrases can now be passed to Users and Groups in the web interface
  • A new warning message appears when removing the last group member in a sub-group which will inherit memberships
  • In the preview it is possible to switch the view to show inherit entries for permissions, allowed actions and resources
  • Added a new label to allowed actions and permissions that tells if it is granted and if it is inherit

Plugins

Web API

  • Update of the permission handling to determine if a user has access to API endpoints

i-net PDFC Server

New Features / Improvements

  • PDFCNunit: Support for multiple .Net Frameworks added
  • JPEG2000 images will be added with original JPEG2000 data to the PDF export
  • The RPC client no longer receives page images if this feature is disabled in the comparison profile
  • The i-net PDFC server stores uploaded files encrypted on the server
  • Tesseract plugins on Windows have been combined into one plugin
  • Textselection added to the web GUI
  • Simple annotations displayed in web GUI
  • The DejaVu fonts will be used as default fonts if i-net PDFC is running on a headless machine without installed fonts
  • It is supported to password protect the exported PDF file containing the comparison result
  • Vastly improved drawing speed for document images, leading to a much faster page loading in the server and desktop application

Fixed Bugs

  • Group "Comparison" was missing in the i-net PDFC Server configuration
  • Hidden differences in graphical presentations occurred due to a merge of difference markers
  • Problems with CosmosDB persistence occurred
  • Following error occurred with enabled OCR comparison: A faulty tesseract configuration. Check the path to tesseract
  • Critical error in PDF export occurred with multiple layer
  • Hidden differences in graphical presentations occurred due to a merge of difference markers
  • HTML Prompt dialog does not appear for guest account
  • The option "Export even if there were no differences" was not used in the batch comparison job of the Task Planner
  • Redirect response was wrong when calling webAPI-compare with a .NET HttpClient
  • Arithmetic overflow occurred due to a very large hard disk quota in the server configuration
  • WebAPI
    • It was not possible to access profiles (shared or not) using WebAPI

i-net PDFC Runtime / Parser / Comparison

New Features / Improvements

  • The internal filter "SOLVEFALSEREPLACE" is now active even for legacy profiles. The filter has been improved and drastically reduces false positives in drawings an shapes with slight position differences due to rounding errors
  • It is now supported to compare annotations as well
  • "Across then down" will be used alwaysif a multi column report will be exported into an endless page output format
  • Performance optimization for high amount of graphic operations with blend mode
  • PDF-parser optimized to use stroke instead of fill if possible, resulting in smaller exported PDF files and more precise rendering
  • Jpeg2000 encoded images supported
  • The font Dejvu-Sans is used as default font for font embedding in PDF export
  • Table comparison overhauled to compare the structure as well. Will now show added/removed cells, columns, rows and tables as well
  • Text location check in strict mode will now only check the position along the baseline of the text and no longer all bounds of each word. This is more robust if the font family or size is changed as well
  • Header/footer detection in documents with large line heights improved
  • Recognition of the text styles subscript, superscript and strike through for both PDF and DocX
  • Improved table recognition for tables with header box, "cross tabs" and tables with only inner borders
  • Link-Verification now checks relative URLs for potential http-Protocol as well
  • Handling for incorrect PDF files improved, shapes will be ignored in that case
  • Multi column detection for plain two column layouts and heading + columns scenarios improved
  • Visibility calculation improved for shapes with mixed fill+stroke colors and redundant elements
  • 'Compute actual visiblity' improved - it will now exclude text on filled background of equal color as well
  • Word detection and separation improved in case of chunking inside a numerical value
  • Tesseract OCR:
    • The tesseract plugin now clear the tmp files after the usage
  • DOCX parser:
    • Fallback added that is used in case of not supported pattern
    • Improvements of the DOCX parser

Fixed Bugs

  • Fixed incorrect white space detection in case the same font is embedded multiple times in a PDF file
  • Wrong difference details reported: Text in two table columns was moved to the same X,Y position
  • Rendering issues occurred for PDF file where the graphics states are not properly closed
  • Text in Courier New font not being displayed in comparison result
  • Some parenthesis not displayed in comparison result because of index bug in font generation which leads to missing characters
  • Line height calculation was wrong for inconsistent fonts
  • Image serialization disparity in the swapping mechanism occurred. This could lead to rare image differences in high load scenarios
  • NullPointerException occurred. To solve it we improved the handling of defective PDFs (missing PatternType parameter)
  • Incorrect differences occurred due to a zero-width non-joining character
  • A text with vertical font was not displayed and the position was wrong
  • Glyph was missing in rendering due to an inconsistent font entry in the source PDF
  • NullPointerExceptino occurred if the compared Docx files has no style information
  • Line height calculation für inconsistent fonts was incorrect
  • Graphic state was not reset for exported comparison result
  • Additional page border in single side export removed
  • Cmap handling for TrueTypeFonts was incorrect. Additional brackets have been inserted between characters
  • Layout problems with centered tabs occurred
  • Multiple font issues occurred, e.g. with wrong font information in PDF for text with 0 width
  • Scroll bug in desktop application occurred at the end of the documents in strict comparison mode
  • Performance issues occurred because of language detection and improved rendering features
  • Different errors occurred due to zero-height text chunks
  • Because of a rounding error on first page footer detection there could be incorrect differences on the first page
  • Table was detected on the first page while the header&footer filter was active
  • Text merge issue in the differences output text occurred. Some white spaces were missing
  • False differences occurred in case of duplicated objected in the source document
  • DOCX parser:
    • Surplus numbering override levels and auto-color in numberings in tables

i-net PDFC Desktop Application

Fixed Bugs

  • Wrong color for textfield in configuration dialogs

i-net PDFC SDK

New Features / Improvements

  • Batch comparison added to the .NET API

Configuration

Fixed Bugs

  • Unnecessary restart message occurred in the web server dialog of the configuration manager if the HTTP port was changed to not default and the HTTPS port is default

SDK

New Features / Improvements

  • Sample plugin for Custom OAuth provider added
  • Methods added to the .NET API:
    • getDifferences returns the list of differences
    • getDifferenceGroupsList returns the list of diffgroups
  • It is supported to print a report (an engine) to a lokal printer, see sample SimplePrint.cs in the SDK

Fixed Bugs

  • System.NullReferenceException occurred when .Net Core was used

Task Planner

New Features / Improvements

  • New Task Planner Job added to determine the free disk space in the working directory, cache and persistence directories. A threshold for minimum available disk space can be defined to trigger actions when there is not enough disk space left

Fixed Bugs

  • Triggering of time-trigger interval 'Two Weeks' was in wrong week at the beginning of a new year

Help Pages

Fixed Bugs

  • Rare error "RejectedExecutionException: Thread limit exceeded replacing blocked worker" occured in the help pages