Skip to main content

Resolved Issues

View the resolved issues for a specific Platform release.

Go to download resolved issues by patch release.

Browse release notes for a selected Pega Version.

NOTE: Enter just the Case ID number (SR or INC) in order to find the associated Support Request.

INC-135849 · Issue 582939

Encrypted SOAP response token generation updated

Resolved in Pega Version 8.5.1

After configuring a SOAP service that used signature and encryption on the response, the response being created was incorrect and could not be decrypted by the receiver. Investigation showed that the API used to generate the SOAP headers was not setting the wsse11:TokenType element, causing receivers which enforce BSP compliance to fail. This has been resolved by modifying the custom webservices-rt-pega2 jar to set the token type in the case of a response encryption policy.

INC-138354 · Issue 584722

Handling added for samesite cookies with httpOnly

Resolved in Pega Version 8.5.1

After enabling samesite cookies on Google Chrome to support Mashup login, intermittent issues were seen with a non-mashup login where entering the OperatorID and password only resulted in a refresh of the login screen. This was traced to a scenario where an httponly cookie attribute was present along with samesite cookie attributes, and has been resolved by adding handling for a condition where samesite is set and httpOnly is enabled.

INC-130145 · Issue 582855

Null checks added for the presence of roles and dependent roles

Resolved in Pega Version 8.5.1

Frequent Null Pointer errors were being generated relating to SecurityAnalysisForSecurityAdministratorsTask.getCurrentSecurityTaskDetails(). Investigation showed that the Origin and Stack trace tabs were empty, leading to the obj-open of the role failing when the role was not available in the system being utilized. This has been resolved by adding a series of null checks for role existence and dependent roles existence.

INC-139867 · Issue 588757

Additional security for encrypted passwords

Resolved in Pega Version 8.5.1

Handling and cleanup has been updated for encrypted values to enhance security.

INC-134315 · Issue 578366

Resolved 400 error on second browser session

Resolved in Pega Version 8.5.1

When accessing application URLs in two tabs of a browser window, logging into the second session was throwing a 400 invalid request. This has been resolved by adding specified activities to an allow list which will bypass URLObfuscation in un-authenticated mode. Non-listed activities will be processed using URLObfuscation if it is enabled.

INC-130500 · Issue 580623

Cross-site scripting protections updated for authorization

Resolved in Pega Version 8.5.1

Cross-site scripting protections have been updated for various URLs associated with authorization.

INC-130299 · Issue 583924

Updated SSO operator authentication handling after passivation

Resolved in Pega Version 8.1.9

With SSO enabled and the pyAccessGroupsAdditional value list populated with the Mapping tab, attempting to access an expired session with an old cookie resulted in a stale thread exception while mapping value list attributes. This was due to using an AuthServicePage which was created by another session thread that had become stale for current session, and has been resolved by updating the code to call the authenticateoperator method on the authservicepage copy.

INC-135874 · Issue 58341

Added handling for password containing a colon on Pega Client for Windows

Resolved in Pega Version 8.1.9

If a password included a colon (:), it was possible to log in on the desktop but not Pega Client for Windows. This was due to authentication files specific to the Windows mobility client, and handling has been added to resolve the issue.

INC-137709 · Issue 584291

New security role added to restrict access to development-specific classes

Resolved in Pega Version 8.1.9

A new security role and related RAROs have been implemented to allow better security for end users on non-BAC systems. This restricts access to Rules and execution of activities on classes that are development-specific.

INC-137978 · Issue 586184

CDK key loading modified for better database compatibility

Resolved in Pega Version 8.1.9

Users were unable to log on to the system and received the error "There has been an issue; please consult your system administrator." Investigation showed the log errors stating "(dataencryption.DataKeyProvider) ERROR localhost - Could not get CDK from systemKeyManagementCache - System CDK is null". This was an issue specific to the MS SQL Server database when there were 6 or more CDKs in the database: CDK keys are loaded from database into Cache using an SQL statement which had the ORDER clause. By default, the ORDER clause treats NULL values differently on different databases, and this caused MS SQL databases to not load a necessary CDK key. To resolve this, the SQL query has been modified so the result will be the same for all supported daatbases (Oracle, Postgres & MS SQL Server).

Ready to crush complexity?

Experience the benefits of Pega Community when you log in.

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us