INC-225503 · Issue 737019
DSS added to configure outflow signature digest method algorithm
Resolved in Pega Version 8.8
After update, a change was seen in the digest method of a SOAP response. The site was configured to use WS-Security Profile SHA-1 as the digest algorithm, but the warning from the testing tool WCF (Windows Communication Foundation) indicated this was not being followed with the message "the algorithm 'xmlenc#sha256' is not accepted for operation 'Digest'". For better compatibility, the DSS outflowSignatureDigestAlgorithm has been added to support configuring the outflow signature digest method algorithm.
INC-225840 · Issue 730754
Key ID made optional for JWT
Resolved in Pega Version 8.8
After update, Connect-REST services were failing with a Admin_Security_Token.Action error. This was traced to kID (key ID) being mandated following previous work done to address an issue. To resolve this and better support backwards compatibility, the kID has been made optional in the JWT header.
INC-226479 · Issue 727465
Cross-site scripting filters added to redirect parameters
Resolved in Pega Version 8.8
Cross-site scripting protections have been added to Param.redirect to improve security.
INC-227736 · Issue 744475
Added polling lock to handle CDK Key rotation issues
Resolved in Pega Version 8.8
An error was generated when attempting to open existing encrypted contacts created in the Sales Automation application. This was traced to multiple nodes generating CDKs simultaneously, leading to a race condition, and has been resolved by refactoring the CDK generation code so it will acquire a lock when polling the database to avoid a race condition.
INC-227769 · Issue 731726
ReloadHarness security updated
Resolved in Pega Version 8.8
Security handling has been updated for ReloadHarness to ensure proper CSRF validation.
INC-228169 · Issue 729003
Login error messages updated
Resolved in Pega Version 8.8
Exception response messages have been updated in order to improve security around attempts to bypass operator authentication.
INC-232970 · Issue 742011
Security update for MashUp
Resolved in Pega Version 8.8
Cross site scripting protections have been updated for the LoadMashupPage activity and RedirectTo parameter.
SR-D87188 · Issue 551350
Mentioned user in Pulse correctly converted to hyperlink
Resolved in Pega Version 8.5
In the Interaction portal, mentioning a user in Pulse using @ was not converting the name to the user name with hyperlink for Email Interactions. @ mentions were working as as expected in Phone Interactions. This problem was introduced as part of using OWASP to sanitize HTML user input in Rich Text support, and was due to OWASP converting @ to an HTML entity. To resolve this, the @ will be excepted from HTML conversion.
SR-D63638 · Issue 544017
Performance improvements for opening cases with embedded images
Resolved in Pega Version 8.5
Opening cases containing email interactions was taking an excessive amount of time. This was traced to the use of embedded images, icons, etc, in the message body and signature, and was caused by the pyGetAttachmentsbyCID activity running multiple times due to discussion threads that were duplicated over and over. In some cases, more than 360 calls to the database were seen. This has been resolved by shifting some case opening processes to executing when the listener thread gets the mail, and storing the results in a .pynote property, and a URL will be used to get images instead of embedding them directly to the HTML. If preferred, this can be reverted to the previous behavior by changing the when rule (pyUseCachedHtmlForDisplay) to false.
SR-D92688 · Issue 551341
Optional feature to improve pxETReport performance
Resolved in Pega Version 8.5
Poor performance was seen when using pxETReport. This was caused by the system loading the recent cases widget by looking up all the ET cases within last 30 days, opening each ET case to check if it is from the same pyFrom email address, and then if yes, opening its related service case. On a complex system, this was potentially a slow process. To improve performance, the "Related cases" feature can now be disabled through an overridable 'when' rule.