Skip to main content

Resolved Issues

View the resolved issues for a specific Platform release.

Go to download resolved issues by patch release.

Browse release notes for a selected Pega Version.

NOTE: Enter just the Case ID number (SR or INC) in order to find the associated Support Request.

Please note: beginning with the Pega Platform 8.7.4 Patch, the Resolved Issues have moved to the Support Center.

INC-194287 · Issue 681065

SSLContext created using protocol from REST connector rule form

Resolved in Pega Version 8.7

After upgrading to IBM websphere v9.0.5.6 or higher, API calls Like REST, Connect-HTTP etc were failing to connect to endpoints using TLSv1.2. Investigation showed that although the connector was configured to send TLSv1.2, the ClientHello handshake was triggered for TLSv1.3. Because the SSLContext was created with highest version supported by protocol in the WAS container, this has been resolved by modifying the code to create SSLContext based on the the protocol selected in the REST connector rule form. Additionally, please note that the Connect-HTTP connector has been deprecated and the Connect-REST capabilities in the platform should be used instead.

INC-196414 · Issue 684238

OAuth token refreshed when revoked on source

Resolved in Pega Version 8.7

When an OAuth token was used to authorize the APIs in the system, revoking the token at the source, i.e. from the Service side, did not automatically refresh the token and a logoff/logon was required before a fresh token was generated. This has been resolved by adding an update to explicitly purge revoked tokens.

INC-196431 · Issue 684886

Refresh assignment checks updated

Resolved in Pega Version 8.7

Additional privilege checks have been added to refresh assignment.

INC-199303 · Issue 690629

Guided Tour working from Actions menu

Resolved in Pega Version 8.7

After updating from Pega 8.4 to Pega 8.5, "Manage a Guided Tour" was no longer working under a local action when called from the Actions menu on a work object. An unspecified error message appeared in the tracer. Investigation showed there was a null pointer error caused by the menu being invoked on an invalid page, and this was traced to updated authentication requirements: registration at the portal is not reliable as it is thread-scoped and run only once. The thread name is not guaranteed to stay the same so subsequent invocations of the tour activities failed. This has been resolved by modifying the call registration function to handle the security issues related to the generation of the menu path.

INC-200299 · Issue 689561

LookUpList correctly executes during SSO login with model operator

Resolved in Pega Version 8.7

After configuring SSO to create operators on fly using a model operator, a new user logging in for the very first time had their operator ID created using the model operator, but after upgrade new users logging in to the system received the error "Only authenticated client may start this activity: RULE-OBJ-ACTIVITY @BASECLASS LOOKUPLIST". This was due to the methods used for additional security on the activity @baseclass LookUpList which allows it to only be run by authenticated users, and has been resolved.

INC-204897 · Issue 695409

Log4j file security vulnerability issue addressed

Resolved in Pega Version 8.7

A zero-day vulnerability was identified in the Apache Log4j logging software which could potentially allow malicious actors to take control of organizational networks. Pega has immediately and thoroughly addressed this issue. More information can be found at https://docs.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability .

INC-164432 · Issue 696292

Global obfuscation key initialized on first requestor call

Resolved in Pega Version 8.5.6

When using URLEncryption = true and SubmitObfuscatedURL = optional, attempting to export an Excel spreadsheet resulted in the error "Invalid character found in the request target". This was traced to the variable pega.d.globalobfuscateKey having a null value which was then converted to a byte array and decoded, generating improper characters in the URL. After a browser refresh, the correct value was set in pega.d.globalobfuscateKey and the export worked as expected. To resolve this, an update has been made to initialize the key on the very first call in PRRequestorImpl when the global obfuscation key is determined to be NULL instead of initializing the global obfuscation key by on-demand basis from HTTPAPI.

INC-173098 · Issue 694091

Signature map updated for fetching keys

Resolved in Pega Version 8.5.6

MFA login worked with SAML 2.0 when the certificate was disabled but failed when the certificate was enabled in Auth Service. The error " "Signature algorithm is null" appeared. This has been resolved by updating the signature map to ignore case sensitivity while fetching keys.

INC-178834 · Issue 660427

RDA support added for Citrix XenApp

Resolved in Pega Version 8.5.6

Robot Runtime was not working in a Citrix XenApp environment when using the JWT token generated by the D_pxRoboticJWTToken data page to identify the user. This has been resolved by updating the scope of the datapage D_pxRoboticJWTToken from node level to requestor, which will allow the user information in the JWT token to be passed to the routing service and support the use of RDA in Citrix environments.

INC-179761 · Issue 684675

Basic Access Control (BAC) now available in production level 2+

Resolved in Pega Version 8.5.6

An enhancement has been added to enable the Basic Access Control (BAC) feature for production levels 2 or greater. This is a change from being available previously only in levels 4 and 5, and will facilitate diagnosing access control issues earlier in the development process.

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us