Skip to main content

Resolved Issues

View the resolved issues for a specific Platform release.

Go to download resolved issues by patch release.

Browse release notes for a selected Pega Version.

NOTE: Enter just the Case ID number (SR or INC) in order to find the associated Support Request.

Please update your bookmarks. This site will be discontinued in Dec 2024.

Pega Platform Resolved Issues for 8.1 and newer are now available on the Support Center.

INC-202122 · Issue 691804

Logging extended for unexpected properties received in HTTP request

Resolved in Pega Version 8.5.6

Additional logging has been added to assist with tracing SECU0001 alerts seen when submitting a case in the interaction portal.

INC-204886 · Issue 698157

Log4j file security vulnerability issue addressed

Resolved in Pega Version 8.5.6

A zero-day vulnerability was identified in the Apache Log4j logging software which could potentially allow malicious actors to take control of organizational networks. Pega has immediately and thoroughly addressed this issue. More information can be found at https://docs.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability .

INC-204897 · Issue 696149

Log4j file security vulnerability issue addressed

Resolved in Pega Version 8.5.6

A zero-day vulnerability was identified in the Apache Log4j logging software which could potentially allow malicious actors to take control of organizational networks. Pega has immediately and thoroughly addressed this issue. More information can be found at https://docs.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability .

INC-206288 · Issue 705270

Addressed intermittent Issues with OAuth2

Resolved in Pega Version 8.5.6

Issues with logging in to a node by way of the access token endpoint were related to the error "JSON web token is rejected during signature verification due to bad signature". This has been resolved by adding clock skew value to the JWT processor bean during validation.

INC-209298 · Issue 704143

Added security tokens to Worklist assignment error wizard

Resolved in Pega Version 8.5.6

After enabling CSRF, moving to 'Configure -> Case Management -> Tools -> Work Admin -> Worklist assignment errors' and then selecting a record and clicking on 'Delete' resulted in a '403 Forbidden' error. This has been resolved by adding CSRF and fingerprint tokens as part of the form data.

INC-164432 · Issue 696294

Global obfuscation key initialized on first requestor call

Resolved in Pega Version 8.6.4

When using URLEncryption = true and SubmitObfuscatedURL = optional, attempting to export an Excel spreadsheet resulted in the error "Invalid character found in the request target". This was traced to the variable pega.d.globalobfuscateKey having a null value which was then converted to a byte array and decoded, generating improper characters in the URL. After a browser refresh, the correct value was set in pega.d.globalobfuscateKey and the export worked as expected. To resolve this, an update has been made to initialize the key on the very first call in PRRequestorImpl when the global obfuscation key is determined to be NULL instead of initializing the global obfuscation key by on-demand basis from HTTPAPI.

INC-182827 · Issue 691528

URL security updated

Resolved in Pega Version 8.6.4

Security has been updated for URL tampering defense and Rule Security Mode.

INC-209298 · Issue 704141

Added security tokens to Worklist assignment error wizard

Resolved in Pega Version 8.6.4

After enabling CSRF, moving to 'Configure -> Case Management -> Tools -> Work Admin -> Worklist assignment errors' and then selecting a record and clicking on 'Delete' resulted in a '403 Forbidden' error. This has been resolved by adding CSRF and fingerprint tokens as part of the form data.

INC-211426 · Issue 706061

UI and code changes to support Client Assertion in Open ID Connect

Resolved in Pega Version 8.6.4

In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.

INC-215343 · Issue 711141

Security updates

Resolved in Pega Version 8.6.4

Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us