Overview

  • The bundled AdoptOpenJDK 11 was updated to version 11.0.12
  • Java 17 supported
  • Update of old versions is now limited. If you are using an unsupported old version, an update to an intermediate version is required
  • It is allowed to create a Let's Encrypt certificate with a callback to the HTTPS port. Problems with redirect to HTTPS and if the server runs only on HTTPS are solved
  • Added QR code to the error page, linking to a help page which may have further details
  • Different ports, configured in the configuration Web Server dialog, use different HTTP sessions
  • An error message occurred during setup if redirect to HTTPS is enabled
  • The plugins dialog in the configuration of the server was replaced by the Plugin Store
  • Memory management for systems with a large heap (>= 4 GB) was improved
  • The version number of plugins now consists of 3 parts
  • The plugin "Web Server Defender" added to protects against DoS and account hacking using brute force
  • The cookie attribute "SameSite" can now be set. The default value is Lax
  • Search bar and ticket views now also support an OR search with the keywords "or", "||" and "|"
  • Embedded web pages now also supports the linking (redirect) of web pages. Additional rights management based on "users and groups" memberships
  • Internet Explorer and the "old" Edge browser (not Chromium) are no longer supported

Security

  • Security Update for CVE-2021-29425
    • In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value
  • Security Update for CVE-2021-28165
    • In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame
  • Security Update for CVE-2021-28169
    • For Eclipse Jetty versions ⇐ 9.4.40, ⇐ 10.0.2, ⇐ 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application
  • Security Update for CVE-2021-21409
    • Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final
  • Security Update for CVE-2021-31812
    • In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions
  • Security Update for CVE-2021-36090
    • When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package
  • Security Update for CVE-2021-35517
    • When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package
  • Security Update for CVE-2021-37714
    • jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes
  • Jetty version updated because of:
    • CVE-2020-27216
      • In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability
    • CVE-2020-13956
      • Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution
    • CVE-2020-27218
      • In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request
    • CVE-2020-27223
      • In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values
  • Guava version updated to 30.1 because of CVE-2020-8908
    • A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured
  • Cron-utils updated to version 9.1.3 because of ​https://nvd.nist.gov/vuln/detail/CVE-2020-26238
  • Security Update for CVE-2020-1967
    • Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)
  • Security Update for CVE-2021-20328
    • Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption
  • PostgreSQL version updated because of CVE-2020-13692

Authentication

  • Plugin "Token Authentication" added. Enables Web API access using access tokens. It allows users to create access token as another means of authentication into their account - but with restricted access scopes
  • Support added for HMAC token authentication like used from MS Teams

New Features / Improvements

  • Generic OpenID Connect (OIDC) authentication provider added
  • Azure OpenID Connect (OIDC) authentication provider added

Fixed Bugs

  • OAuth authentication (Azure) with Safari browser was not possible
  • Permission check for the WebAPI has not worked in connection with the default Windows Authentication
  • URL was wrong after signup with any OAuth authentication provider like Azure and if a reverse proxy (like default.aspx for IIS) was used

Help pages

  • PDF export from a help page was not possible if the browser access occur via a not trusted HTTPS URL

Maintenance

  • Problems with backup of large files from a database persistence (MongoDB, AzureCosmosDB) occurred

Statistics

  • The number of entries for each message in the event log is reduced

Plugins

Discord

  • Discord plugin in category "Task Planner" will be replaced by general Discord plugin. You can find it in Plugin Store category "Communication". If the old plugin was activated, the new one will be installed automatically by the setup

Reporting

  • Set a custom product title for external representation
  • Add WebAPI /api/reporting/report/render endpoint to render reports using Token Authentication

Plugins

Notifications

  • Permanent notifications must be kept in the notification center, even though they are displayed by the operating system

Plugins

Store

  • The store is new and replaces the configuration of the plugins in the configuration
  • New versions and features are requested from the public plugin store and can be installed
  • On future updates, the setup will automatically update all activated plugins from the store

Plugins

Remote GUI

  • Fixed data buffer length for ajax and websocket requests
  • Corrected timeout handling for websocket connections with broken VPN connections

Plugins

Statistics

  • Date and time values now respect the client's time zone when displayed
  • Memory for user and reports now store 20,000 entries as maximum to limit memory consumption

Plugins

Task Planner

  • Long running tasks were sometimes displayed as 'INCOMPLETE'

Plugins

Users and Groups

  • Per URL parameter "s" search phrases can now be passed to Users and Groups in the web interface
  • A new warning message appears when removing the last group member in a sub-group which will inherit memberships
  • In the preview it is possible to switch the view to show inherit entries for permissions, allowed actions and resources
  • Added a new label to allowed actions and permissions that tells if it is granted and if it is inherit

Plugins

Web API

  • Update of the permission handling to determine if a user has access to API endpoints

i-net Clear Reports runtime

New Features / Improvements

  • Word break was improved for a more natural text flow
  • The alignment value of a field will now be applied in case of text interpretation 'HTML-advanced' as well
  • New output format added: Email. It is a simple HTML format. A single file format that can be used as email body. It can be triggered with the URL parameter: init=email
  • Formula function AddAttachment(String,Binary) added. It can be used to add embbedded files to PDF output format
  • Support for WebP images and other image formats added. The plugin "ImageIO Extension" is required. It can be installed using the plugin store
  • PDF export: Character replacing for embbeded fonts containing character which are in code blocks which are not in the code block list of the font
  • Reuse of images when exporting an embedded PDF to PDF, reduces the overall file size
  • Jpeg2000 encoded images supported
  • Font replacement improved for PDF reports if enabled
  • Perfomance of DatabaseMetaData.getTables() improved
  • HTML export:
    • New implementation of HTML-Advanced in HTML-Export added. The result will now be fixed by i-net Clear Reports, leaving less room for render differences in the client browser
  • XLSX / ODS export:
    • Cell-Distribution of output formats XLSX and ODS completely rewritten
    • For compounds reports with URL parameter "reports" the table sheets in ODS/XLSX use the title of the underlying rpt file. In older versions the title of the first rpt file was used

Fixed Bugs

  • Column width and coordinates of a text box inside multi column layout in sub reports was wrong for ODS and XLSX format
  • HTML format:
    • Image alignment in text with text interpretation Basic HTML was incorrect
    • Regression in version 21.4: Advanced HTML layout does not handle NULL values for the HTML output format
  • Embedded scanned PDF files was incorrect displayed in the PDF export. Depending of the structure of the embedded PDF file some images could be replaces with other images of the same document
  • Ignore expired sessions when calling: DataSourceConfiguration.getDataSource(x)

Changed Behavior

  • PDF export: The rendering time is used as creation time of the PDF file. In earlier versions it was the creation time of the rpt template
  • The XLSX / ODS export creates fewer very small columns. This can cause problems if the report elements are not very well aligned and also very tightly designed
  • Embedded fonts preserved the original font family name now. This can result in a different printing output (print job size) via Java report viewer client if the same font is installed on the client system

i-net Clear Reports Server

Fixed Bugs

  • The initialization for WebSocketEndPoint to be registerable in Oracle Weblogic was changed. This fixed the error `java.lang.IllegalStateException: Not in 'deploy' scope
  • Problems with CosmosDB persistence occurred
  • The error "java.lang.IllegalStateException: Not in 'deploy' scope" occurred if the WAR file of the i-net Clear Report Server was deployed in Weblogic Server 12.2.1.4. To solve it changed the initialization for WebSocketEndPoint to be registerable in Oracle Weblogic. Migration: In the web.xml of the a WAR file you need to add the listener com.inet.http.ExpandableServletContextListener
  • Access to repository from remote designer has not worked if report server was deployed as Servlet in an application server

HTML Report Viewer

Fixed Bugs

  • Color differences occurred when printing report with enabled/disabled HTML report viewer toolbar

Task Planner

New Features / Improvements

  • Formula expression result added as placeholder in result actions. It can be used to return a single value from the report to the task planner which can then be used using the [report.formula] placeholder
  • New Task Planner Job added to determine the free disk space in the working directory, cache and persistence directories. A threshold for minimum available disk space can be defined to trigger actions when there is not enough disk space left
  • Private key authentication to Task Planner FTP tasks added

Fixed Bugs

  • Triggering of time-trigger interval 'Two Weeks' was in wrong week at the beginning of a new year

Configuration

Fixed Bugs

  • Unnecessary restart message occurred in the web server dialog of the configuration manager if the HTTP port was changed to not default and the HTTPS port is default

SDK

New Features / Improvements

  • Sample plugin for Custom OAuth provider added
  • A report (engine) can be printed to a local printer using .NET API

Help Pages

Fixed Bugs

  • Rare error "RejectedExecutionException: Thread limit exceeded replacing blocked worker" occured in the help pages

Report Server

New Features / Improvements

  • Web API: Upload and verification of a single or multiple file resources into the repository enabled
  • Apache Cassandra database supported as datasource. The CQL (Cassandra Query Language) can be used to fetch data
  • MongoDB database supported as datasource
  • Perfomance of DatabaseMetaData.getTables() improved

Fixed Bugs

  • Some PDF files embedded in the report are incorrect displayed in the PDF export. Depending of the structure of the embedded PDF file some images can be replaces with other images of the same PDF document
  • ClassCastException in Maintenance with MongoDB persistence occurred

i-net Designer

New Features / Improvements

  • Weblog datasource added

Fixed Bugs

  • Rendering issues occurred in the "Options | i-net Clear Reports". The "i-net Clear Reports" icon was missing and the dialog "Manage configurations" was not displayed correctly

Report Repository

New Features / Improvements

  • It is possible to upload and verify a single or multiple file resources into the repository using Web API

Fixed Bugs

  • Prompt request dialog did not work in the report repository when using a guest account