オンプレミス版のリリース情報

Added Spring support for Accessing Relational Data using JDBC.

You can now access JPA Data with REST in Spring.

jaxrs/Jersey vulnerabilities not triggered due to losing track of tainted data.

Race condition with CreateApp settings meaning Server level disabled rules are used.

Protect false negative: Jackson unsafe deserialization (CVE-2017-17485).

finding-send broken due to FrameworkManager bringing in dispatchers from java.lang.

Agent fails to request permission before calling setAccessible.

Command Injection in Protect received false positive from argparse4j.

Agent on WebSphere changes handling of disabled TLS algorithms.

Spring PathVariable is not detected as a source.

Dataflow is lost through some Spring Util classes.

False positive unvalidated forward in Tomcat with Spring DeferredResult.

SQLi FP with HttpClient's RetryExec with MariaDB

False positive received with XSS Keyword.

-Dcontrast.rootapp name ignored when ServletContext.getServletContextName() returns non-empty value.

Added connect to contrast-dotnet-diagnostics to test the agent’s ability to connect to Contrast.

Added config-keys to contrast-dotnet-diagnostics to display configuration options supported by the agent.

Added cert-info to contrast-dotnet-diagnostics to display information about the certificate provided by the value of the api.url configuration setting.

Improved the performance of Protect SQL-Injection detection.

Improved the performance of Protect against XML-based inputs.

Added validate-yaml to contrast-dotnet-diagnostics to verify the agent’s contrast-security.yaml configuration file.

The agent’s file analysis rules now execute within the context of the agent’s sensors component. These rules will now execute in Azure App Service and Docker deployments. Previously these rules only executed in the agent’s background Windows service component.

When a third-party profiler would be chained with Contrast, that profiler could instrument some internal Contrast methods which lead to some instability. This issue has been fixed now.

The agent could fail to properly observe some Web API 2 routes. This issue has been fixed now.

When an OWIN-based application was deployed to Azure App Service, the agent would cause an application error. This issue has been fixed.

When the agent’s background Windows service was shutting down it could sometimes harmlessly crash. This issue has been fixed.

Added connect to contrast-dotnet-diagnostics to test the agent’s ability to connect to Contrast.

Added config-keys to contrast-dotnet-diagnostics to display configuration options supported by the agent.

Added cert-info to contrast-dotnet-diagnostics to display information about the certificate provided by the value of the api.url configuration setting.

Improved the performance of Protect SQL-Injection detection.

Improved the performance of Protect against XML-based inputs.

Added validate-yaml to contrast-dotnet-diagnostics to verify the agent’s contrast-security.yaml configuration file.

Added multiple architecture changes and fixes that improve Assess performance.

Added support for URL Exclusions when using Assess.In Contrast, you can designate URLs that ignore selected rules or all rules.The agent now respects these settings for Assess rules in the Node.js agent.

Protect rule modes now default to OFF for best backward and forward compatibility.

Improved Fastify support to work better with GraphQL and Apollo Server.

Removed support for Protect Cross-site Request Forgery (CSRF).

Updated the version of Lodash used by the Node.js agent to 4.17.19 in response to a CVE for Lodash 4.17.15.

Version 3.0.0 of the Node.js agent will be released at the end of August and will introduce these changes:

All new features will only be available for 3.0.0 and higher.Version 2.18.0 will also be released at the end of August and will be the final version that doesn't require the Contrast service.This version will continue to be supported for patch releases.

There are two optional features that may be useful to some customers.Contact your Customer Success Representative if you would like to know more about these:

Node.js agent failed to initialize.Missing gRPC framework was resolved.

An exception occurred because of a syntax error for Fastify.This was fixed.

Crash when requiring the aws-s3 module was resolved.

Replaced google-protobuf with protobuf.

Improved logging to include Thread Id as well as Process Id.

Removed custom Contrast::InternalException in favor of common exception types to improve error handling.

The change of dependency from google-protobuf to protobuf, removes the need to execute the bundle config force_ruby_platform true command before installation.

In 2020, the cucumber project forked protobuf for their own use in a way that is incompatible with the main branch.As such, you cannot run any project using cucumber-messages above version 8.0.0 as it depends on the incompatible protobuf-cucumber.

Improved handling of logging to unwritable destinations.

Improved handling of propagation to children of the String class.

Improved handling of propagation through Regular Expression where the result of a match is nil.

Added route coverage support for Django 3.0.

Added Falcon 2.0 support.

Improved accuracy of library file usage.

Improved propagation through regular expressions in Assess.

The team made significant internal cleanup to Request representation

Fixed a bug where regex propagation was throwing an exception under certain conditions.

Fixed a bug related to agent handling of very short JSON keys and values.

Updated protobuf dependency requirement in response to incompatibility issues with older versions.

Fixed an issue where the agent raised an internal exception for applications using certain features of pyasn1.

Fixed a bug where Django applications were unable to properly parse the Content-Type header if a charset was explicitly provided.

Improved error handling around stack trace construction.

Added support for (WebSphere) Route Discovery for Servlet 2.5 Declarative Servlets.

Increased sensitive data masking coverage, specifically for SQLi, XSS, Command Injection, Path Traversal, CSRF, ReDoS, OGNL Injection.

XXE vulnerability missed in Assess but flagged as path traversal

UI displaying blocked and exploited HTTP Method Tampering events

Protect was receiving false negatives for XSS Bypass via Bug Bounty

Spring auto binding rule causing false negatives

Protect Path Traversal False Positive due to base64 null char

NPE in ContrastHttpRouteRegistrationWatcherDispatcherImpl

ReportFindings acceptance test annotation is broken

Improved detection of dangerous path use in Protect; specifically, when interacting with the file system (path-traversal-semantic-dangerous-paths rule) and in arguments to OS commands (cmd-injection-semantic-dangerous-paths rule).

Beginning with this release, the minimum supported operating system is Windows Server 2012 and the minimum .NET Framework version is .NET 4.7.1.

The legacy .NET Framework agent maintains support for Windows Server 2008 and older .NET Framework versions. The legacy agent has all of the current features of the .NET Framework agent and receives critical bug fixes but otherwise will not be further developed.

When an application sent a request to the same URL as the current request, the agent would report an SSRF vulnerability. This is fixed now.

When the agent would report an xcontenttype-header-missing vulnerability, it was rejected due to missing information. The agent now sends all expected information for this vulnerability.

Improved detection of dangerous path use in Protect; specifically, when interacting with the file system (path-traversal-semantic-dangerous-paths rule) and in arguments to OS commands (cmd-injection-semantic-dangerous-paths rule).

The agent will no longer attempt to load under .NET Core versions less than 2.1 as these versions are not supported.

When an application sent a request to the same URL as the current request, the agent would report an SSRF vulnerability. This is fixed now.

When the agent would report an xcontenttype-header-missing vulnerability, Contrast would reject the vulnerability report due to missing information. The agent now sends all expected information for this vulnerability.

When an instrumented application closed the response stream, the agent could cause an application error. This is fixed now.

When an instrumented application seeked within a response stream, the agent could cause an application error. This is fixed now.

New recommendations for installing and running the Node.js agent have been released.

The customer application would fail to start when all Assess rules were disabled.This is fixed now.

The customer application would fail to start because worker threads would hang and generate multiple processes with the same pid.This is fixed now.

The agent would not output the security log to stdout (or stderr).This is fixed now.

Duplicated vulnerabilities were being reported for unique routes.This is fixed so that TeamServer displays distinct findings for each request uri.

An out-of-memory error caused by a regex match resulted in an infinite loop.This has been fixed.

Node.js agent’s migration to npm and incorrectly bundled modules made it seem like the agent was missing two dependencies.This has been resolved.

Added support for Django Rest Framework

Added copyright to all agent files

Removed the agent's external dependency on the wrapt package

Improved INFO level logging for easier tracking of applications with multiple processes

When running the agent with protobuf-3.6.1 sometimes the application crashed, which has now been resolved with a newer protobuf version.

Improved Stack Trace capturing

Improved library analysis performance leading to a decrease in first request penalty

The Agent now supports TRACE level logging.Those running with DEBUG logging should see a significant decrease in logged events

Provided route coverage support for the Servlet API.

Implemented Sensitive Data Masking with the mask_attack_vector.

Added Assess support for DynamoDB.

Protect caches input no matter the size potentially leading to OOMs for large requests

Undertow Resource Handlers Should Not Trigger Path Traversal Attacks

Path Traversal False Positive Due to Spring's ServletContextResource

Race condition in App Inventory along with Protect Struts Cve rules

Log4j2 instrumentation fails on Log4j2 2.13.1

Agent Reports Incorrect HTTP Protocol Version on Servlet Containers

Protect SQLi SimpleOrSearcher has poor performance on large inputs

Assess CSRF Detection Fails When Request Uses form-data/multipart

SSRF detection must not take use of tainted path as a SSRF vulnerability

Java Agent does not provide a findings field for PathTraversalSemanticDTM

Agent Prevents Graceful JVM Shutdown

Fix performance metric reporting for Acceptance Tests

StringUtil methods for case sensitive string comparison are wrong for non alphabet inputs

Improved the Assess analysis used to identify SSRF vulnerabilities to reduce the number of false positives reported by the agent.

Improved the Protect analysis used to analyze user inputs for potential SQL injection attacks to improve accuracy and performance.

The agent will now clean up old logs.

Removed the dependency on Microsoft.Extensions.Caching.Memory.

Improved performance of Protect XSS.

Improved performance of Protect SQL-Injection.

When the agent would report vulnerabilities for four response-based Assess rules related to CSP and HSTS, the report would be rejected by Contrast due to missing information. The agent now sends all expected information for these rules.

When an instrumented application defined a type using a large number of nested generic types, the agent could cause a StackOverflow error. This has now been fixed.

When a user would disable multiple Protect rules through the ‘contrast.protect.disabled_rules’ setting in the yaml file, the agent would not respect this setting. The agent will now respect this configuration setting.

When a user would disable logging, the agent’s profiler component would still log high level information during initialization. The profiler will no longer create a log when logging is disabled.

Multiple architecture and performance improvements.

New gRPC communication protocol between the agent service improves performance.

Removed name and value cookie sources for reflected XXS per updated guidance for both Assess and Protect.

Added a sensor for SQLite for Protect.

Added support for Koa version 2.12.

Reflected XSS is now not reported if Content-Type is allowlisted as safe.

A major version release for the Node.js agent is planned for late July or August 2020.Node.js agent version 3.0.0 will introduce breaking changes for customers using the 2.x.x version of the agent and service.

Implemented multiple bug fixes due to the introduction of the gRPC communication protocol between the JavaScript agent and the agent service

Implemented fixes to resolve route coverage issues that surface when using graphQL, Apollo Server, and Fastify

Resolved a false positive issue when correctly using Sequelize to escape strings.

Resolved exception when fastify.route is called with an uppercase verb.

Resolved an issue that manifested as reporting duplicate routes when using the Express framework.

Falcon 2.0 is supported and is in beta

Upgraded Contrast Service to 2.8.1

Caching of settings to improve performance and reduce memory impact

Deprecation of CSRF Assess and Protect rules

Contrast Assess more accurately detects Path Traversal vulnerabilities. Contrast Assess and Protect more accurately detect vulnerabilities and attacks respectively in Apache Struts based applications. Contrast Protect more accurately detects SQL Injection attacks.

This release includes breaking changes to Contrast Assess route coverage reporting when used with on-premise Contrast servers version 3.7.2 and older.

When WebSphere users configured their WebSphere services with custom TLS certificates, the Contrast Java agent prematurely initialized WebSphere's certificate manager as a side-effect. This caused the WebSphere TLS connections to fail unexpectedly. This issue has been resolved by adding a special exception for WebSphere to Contrast's TLS initialization whereby Contrast will use an isolated `SSLSocketFactory` instead of the Java runtime's default system socket factory.

When users configure their application with a session-based vulnerability auto-verification policy, and the user does not configure their Contrast agent with an explicit session_id configuration parameter, then Contrast wrongfully auto-verifies vulnerabilities. We resolved this issue by fixing a race condition, so we can ensure that auto-verification will work as expected when the user has configured their agent to use the contrast.agent.java.standalone_app_name configuration.

Improved handling of scenarios where the agent would write repeated errors to log files, creating larger than necessary log files.

The agent will now log unknown configuration keys at startup. This should help with troubleshooting configuration issues (for example, invalid yaml).

The agent’s auto-update feature will no longer update the agent when running on Windows Server 2008 or servers with .NET Framework 4.7.0 or older. This change is in preparation for the upcoming fork of the Contrast .NET Framework agent. See below for more details.

The next release of the .NET Framework agent will raise the minimum supported operating system to Windows Server 2012 and raise the minimum .NET Framework version to .NET 4.7.1. Support for Windows Server 2008 and older versions of the .NET Framework will be maintained via a fully featured legacy .NET Framework agent. This legacy agent will have all of the current features of the .NET Framework agent and will receive critical bug fixes but otherwise will not be the focus for future .NET development.

When an application hosted on IIS was (mis)configured without a virtual path, the agent’s background Windows service would crash. The agent’s background Windows service now properly handles this configuration.

A race condition around requests for configuration values that did not have default values could lead to a crash of the agent’s background Windows service. The race condition has been fixed, default configuration values have been provided for all configuration options, and missing default configuration values are now properly handled.

Added support for Linux Azure App Service.

Added support for Alpine.

Improved handling of scenarios where the agent would write repeated errors to log files, creating larger than necessary log files.

The agent will now log unknown configuration keys at startup. This should help with troubleshooting configuration issues (for example invalid yaml).

When applications redirected to a URL that had been validated using Url.IsLocalUrl, the agent would still report an unvalidated redirect vulnerability. The agent will now respect the Url.IsLocalUrl validator.

A race condition around requests for configuration values that did not have default values could lead to an unhandled error in the agent. The race condition has been fixed, default configuration values have been provided for all configuration options, and missing default configuration values are now properly handled.

Fastify framework support: Fastify 2.x is now a supported framework for the Contrast Node.js agent.

NPM availability: The Contrast Node.js agent can now be installed directly from the Contrast Security public NPM repository

Pre-load capabilities: The Node.js agent can now be run as a pre-load module using the -r flag.This is also now the recommended method of running the Contrast Node.js agent.

Running the node agent as a runner will now generate a deprecation message.This is the deprecated syntax:

node-contrast<app-main>

The agent will continue to function when executed as a runner.However, we encourage customers to migrate to the new method of running the Contrast Node.js agent as this is no longer recommended.

After architecture improvements were made to the agent, some applications were prevented from starting with the agent.This has been resolved and users should no longer receive error messages like these:

cls.run(() => {
    ^
TypeError: Cannot read property 'run' of undefined

OR

/usr/src/app/node_modules/node_contrast/lib.asar/AsyncStorage/index.js:188
    if (ns.active) {

TypeError: Cannot read property 'active' of undefined

Added initial support for Stored XSS rule in Assess for django framework.

Added Unvalidated Redirect support for Assess for pyramid and webob objects.

Made updates to reduce number of false positives from Reflected XSS rule in Assess.

Removed the agent’s external dependency on the six package.

When running the agent under Python 2.7 on Ubuntu 16.10 some instrumentation failed to apply, which has now been resolved.

When applications used str.format in certain edge cases, the agent lost dataflow propagation, which has now been resolved.

Enhanced module definition detection using TracePoint

This will be the last on-premises release bundled with a gem that supports Ruby 2.4.

It is recommended to use RubyGems at this point.