Teknik Destek
Nasıl Yapılır?

ArcGIS Server Security 2021 Update 2 Patch Yayınlandı!

Tanım

Bu güvenlik yaması ArcGIS Server’da bulunan birçok güvenlik açığını ele alır. Esri, ArcGIS Server 10.9, 10.8.1, 10.7.1, and 10.6.1 kullanan tüm kullanıcıların bu yamayı uygulamasını önermektedir. Bu yama spesifik olarak “Bu yama ile ele çözülen sorunlar” başlığı altındaki sorunları ele almaktadır.

Bu yama ile ele çözülen sorunlar

  • ArcGIS Server Security 2021 Update 2 Patch
  • BUG-000113339 – The ArcGIS Server versions 10.6 or 10.7.1 export site operation returns the error message, “Export operation failed. null” within Amazon Web Services (AWS) on Microsoft Windows and Linux (or Azure). (10.7.1 only)
  • BUG-000139857 – Remote file inclusion vulnerability in the ArcGIS Server help documentation
  • BUG-000142180 – Stored XSS vulnerability in ArcGIS Server (10.8.1 and 10.9 only)
  • BUG-000142120 – SQL injection vulnerability in ArcGIS Server
  • BUG-000142204 – Setting a field invisible in a hosted feature service view requires hiding the field references from the templates.

Bu yamanın 10.9 versiyonu ayrıca aşağıdaki konuları da içerir

  • BUG-000141023 – Remove restrictions on interval parameters when used in enterprise hosted feature service layer queries.
  • BUG-000141022 – Hosted feature services in Enterprise need to return uncompressed responses when requested.

Bu yamanın 10.8.1 versiyonu ayrıca aşağıdaki konuları da içerir

  • BUG-000138234 – The WebGIS DR backup fails when attempting to create a service.
  • BUG-000137668 – Stored XSS vulnerability in ArcGIS Server Services Directory
  • BUG-000137663 – Stored XSS vulnerability in ArcGIS Server
  • BUG-000137662 – Reflected XSS in ArcGIS Server
  • BUG-000137658 – SSRF vulnerability in ArcGIS Server Manager.
  • BUG-000135919 – When the ArcGIS Server site import fails when using the DR tool, the site is not returned to a functional state.
  • BUG-000135918 – Importing an ArcGIS Server site using the DR tool may fail sporadically.
  • BUG-000135563 – If the field name is named with multibyte strings, using the WHERE clause as the query operation with the field fails.
  • BUG-000134113 – Only update service iteminfo when the Item Description fields are purposefully edited within Server Manager.
  • BUG-000133232 – Add support in ArcGIS Server to ensure ArcGIS Enterprise portal members with custom roles are able to delete their own services when the role includes administrative privileges such as ‘View all members’ and publisher privileges.
  • BUG-000132999 – In a multi-machine ArcGIS Server site, the restore process may not successfully unregister, and re-register the additional nodes.
  • BUG-000131992 – Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
  • BUG-000127160 – Error enabling Location Tracking when the configuration store is in the cloud storage.

Bu yamanın 10.7.1 versiyonu ayrıca aşağıdaki konuları da içerir

  • BUG-000137668 – Stored XSS vulnerability in ArcGIS Server Services Directory
  • BUG-000137663 – Stored XSS vulnerability in ArcGIS Server
  • BUG-000137662 – Reflected XSS in ArcGIS Server
  • BUG-000137658 – SSRF vulnerability in ArcGIS Server Manager.
  • BUG-000132311 – Unable to view service workspace information in Server Manager when the site’s config-store is stored in S3/DynamoDB in AWS
  • BUG-000131992 – Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
  • BUG-000130002 – ‘GetFolders’, ‘GetDescriptions’, and ‘GetDescriptionsEx’ requests fail in ArcGIS Server 10.7.1 deployments on Amazon Web Services.
  • BUG-000128892 – Caching with 64 or more instances on a single machine may fail despite sufficient system resources.
  • BUG-000128060 – ArcGIS Server has a Server Side Request Forgery (SSRF) security vulnerability.
  • BUG-000127160 – Error enabling Location Tracking when the configuration store is in the cloud storage.
  • BUG-000127113 – Unable to connect to identity store using Asp.net using ArcGIS Server 10.7. or later after restarting the ArcGIS Server Windows service.
  • BUG-000125331 – CreateReplica with registerExistingData needs to account for service URLs with different machine names for hosted FS
  • BUG-000125214 – Optimize the deletion of services to avoid time-outs on deployments that include a large number of services.
  • BUG-000125044 – Hosted feature service has a stored cross-site scripting (XSS) vulnerability.
  • BUG-000124991 – ArcGIS Server fails to fully import root or intermediate certificates.
  • BUG-000124867 – When attempting to download a managed map area in Collector for ArcGIS, the download fails due to an error that occurs between ArcGIS Server and the ArcGIS Web Adaptor replica access.
  • BUG-000124827 – On a multiple-machine ArcGIS Server site that has one or more cached map services that have been consumed through ArcMap or a SOAP client, publishing a service or stopping/starting a service causes all services on the machines to restart.
  • BUG-000124576 – Starting a map service with a Java SOAP server object extension (SOE) enabled fails with the error “javax/xml/bind/JAXBException”.
  • BUG-000124287 – Publishing fails because enterprise database registration fails, even though it appears to work on the UI. This could happen on a machine configuration that has multiple Network cards.
  • BUG-000123103 – ArcGIS Server improperly handles an incorrect CORS origin.
  • BUG-000122285 – Scalability of 3D Scene Service is impeded by frequent reads/writes to the config store and directories.
  • BUG-000120535 – In the Operations Dashboard for ArcGIS serial chart in Portal for ArcGIS, sorting data by statistics in the Data Options configuration returns the warning message, “Cannot Access Data.

Bu yamanın 10.6.1 versiyonu ayrıca aşağıdaki konuları da içerir

  • BUG-000137702 – Addresses a crash in ArcGIS when working with PMF files
  • BUG-000137668 – Stored XSS vulnerability in ArcGIS Server Services Directory.
  • BUG-000137663 – Stored XSS vulnerability in ArcGIS Server.
  • BUG-000137662 – Reflected XSS in ArcGIS Server.
  • BUG-000137659 – Cross-site scripting (XSS) in ArcGIS Server Manager.
  • BUG-000137658 – SSRF vulnerability in ArcGIS Server Manager.
  • BUG-000134965 – There is a SQL injection vulnerability in ArcGIS Server.
  • BUG-000132034 – In Portal for ArcGIS, when the name of the attachment file is Japanese, an attached file is unable to open but can be downloaded.
  • BUG-000131992 – Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
  • BUG-000131010 – The Find command in ArcGIS Desktop and ArcGIS Servers REST endpoint takes exponentially longer to execute from 10.6.0 to 10.6.1.
  • BUG-000130724 – The Con method of the Spatial Analyst component RasterConditionalOp fails with error unexpectedly when called in a pre-10 syntax.
  • BUG-000128883 – The Register with Geodatabase geoprocessing tool loads and operates slowly in ArcMap when registering large spatial tables or views with an enterprise geodatabase.
  • BUG-000128381 – One-way replica synchronization fails with error: ‘Synchronize Replica Failed [.] Table not registered [PEA.GDB_TEMP_USER_IDS]’.
  • BUG-000128060 – ArcGIS Server has a Server Side Request Forgery (SSRF) security vulnerability.
  • BUG-000126701 – Hosted services fail to restore if their associated view is alphabetically listed after the hosted service.
  • BUG-000126173 – GeoAnalytics Server doesn’t support connections to Hadoop with Kerberos authentication when Hadoop’s hadoop.rpc.protection property is set to “privacy” or “integrity”.
  • BUG-000125044 – Hosted feature service has a stored cross-site scripting (XSS) vulnerability.
  • BUG-000124827 – On a multiple-machine ArcGIS Server site that has one or more cached map services that have been consumed through ArcMap or a SOAP client, publishing a service or stopping/starting a service causes all services on the machines to restart.
  • BUG-000124386 – Correct the order of operations during importSite.
  • BUG-000124326 – Renaming an SDO_Geometry feature class fails on Oracle 19c.
  • BUG-000124325 – Create Spatial Type fails on Oracle 19c.
  • BUG-000124079 – Running block adjustment on imagery collection the second time may fail with missing default elevation value.
  • BUG-000123103 – ArcGIS Server improperly handles an incorrect CORS origin.
  • BUG-000122408 – A custom certificate for the server of the web server is not maintained when restoring a webgisdr backup.
  • BUG-000122285 – ArcGIS Enterprise 3D scene services deliver poor throughput and do not scale well across multiple GIS nodes.
  • BUG-000121595 – Occasional/Intermittent site creation and create service/Delete service issue with Server.
  • BUG-000120805 – ArcGIS Server has an access control issue.
  • BUG-000120195 – Failed to restore hosted services containing associated views.
  • BUG-000119801 – Sample fails when more than one mosaic datasets are input as input rasters.
  • BUG-000119759 – Improve the quality and performance of the Sample tool.
  • BUG-000119534 – Path Allocation produces incorrect results when the source characteristics are specified.
  • BUG-000119493 – Sink tool creates two unique values for sink regions that are diagonally connected. This is incorrect as diagonally connected sinks should be identified with a single unique value.
  • BUG-000119425 – The SummarizeRasterWithin and ConvertRasterToFeature tasks in ArcGIS Image Server crashes when trying to directly read an input image service collocated on a cloud raster store.
  • BUG-000119424 – Zonal Geometry as Table and Zonal Geometry tools generate incorrect results when a field other than value was used. In this case, the logic for calculating zonal geometry properties is not correct, and the software may crash.
  • BUG-000119423 – Watershed tool hangs when processing extent is set to a single cell catchment.
  • BUG-000119422 – Flow distance tool in modelbuilder does not display ‘FlowDistanceType’ parameter.
  • BUG-000119421 – Flow Distance tool produces NoData for majority of cells when input surface raster is not hydro conditioned.
  • BUG-000119419 – Euclidean Direction using high resolution data produces incorrect output.
  • BUG-000119323 – RasterToPolygon with “Create multipart features” enabled, locks the output for editing.
  • BUG-000119030 – Querying or selecting from a compressed file geodatabase over eight times in ArcGIS Desktop 10.6.1 is slower than in ArcGIS Desktop 10.5.1.
  • BUG-000118421 – If there are non-English characters in a connection string, the Copy Raster tool will return this error when importing a raster in an enterprise geodatabase, “ERROR 999999: Error executing function. No raster store is configured. Not running inside a server process. Failed to execute (CopyRaster).”
  • BUG-000118138 – ArcGIS Double fields with precision = 10 and scale = 0 in an Oracle geodatabase are altered automatically to Long Integer after previewing in ArcGIS 10.6.1/ArcGIS Pro 2.2 or later clients. An error is returned, “[ORA-01455: converting columns overflows integer datatype]” if the fields contain numbers larger than the maximum for a Long Integer (2,147,483,647).
  • BUG-000117983 – Access control issue in the ArcGIS Server tile handler.
  • BUG-000117954 – Scene service should ignore certificate errors while consuming scene caches in scene viewer.
  • BUG-000117633 – In 10.6.1 and prior, the message bus platform service may not be initialized correctly in all environments.
  • BUG-000117372 – Cross-site scripting (XSS) in Server Admin api.
  • BUG-000116972 – Collector for ArcGIS (iOS) fails to submit photo attachments to hosted feature layers in ArcGIS Enterprise 10.6.1.
  • BUG-000116589 – Cost Path and Cost Path as Polyline with flow direction input for backlink raster is slow.
  • BUG-000116047 – Cost Path produces incorrect output when Flow Direction raster is used as input for distance and backlink raster.
  • BUG-000115799 – Vector Tile Layers hosted in ArcGIS Enterprise 10.6.1 do not overzoom successfully when viewed in the Map Viewer.
  • BUG-000115304 – In multiple ArcGIS Server machine sites, the ImportSite operation modifies the server machine property options pertaining to HTTPS on machines other than the one running the Importsite.
  • BUG-000115147 – When calling ITopologicalOperator::Buffer on a polygon, if the polygon is degenerated to a point, the buffer call crashes.
  • BUG-000113368 – Euclidean allocation, distance and direction tools are much slower in current version verses previous version of ArcMap.
  • BUG-000113339 – The ArcGIS Server 10.6 (or 10.7.1) export site operation returns the error message, “Export operation failed. null” within Amazon Web Services (AWS) on Microsoft Windows and Linux (or Azure).
  • BUG-000111075 – A feature service consumed in a GeoEvent Service fails to re-establish communication with the database once the database connection comes back after a communication failure.
  • BUG-000111075 – Service recycling after a DB connection failure does not happen for Feature Server.
  • BUG-000098315 – Sample return Null data, when input raster is Mosaic.
  • BUG-000096996 – ExtractMultiValuestoPoints, ExtractValuestoPoints returns error when the input points feature is a XY Event Layer.
  • BUG-000089296 – Feature service attachments in ArcGIS GIS Server are downloaded in Mozilla Firefox and Google Chrome web browsers, instead of being opened in a new browser tab or window.

Faydalı Bağlantılar

  1. https://support.esri.com/en/download/7937
  2. ArcGIS Server Security 2021 Update 2 Patch
  3. Check for and install software patches and updates

 

 

 
Bu Sayfada
Benzer İçerikler ArcMapServiceCheck ile servisleri kontrol etme Arcade koşullu fonksiyonlarını ArcGIS Online’da NULL veya NOT NULL değerlere uygulama ArcGIS Online ve Portal for ArcGIS’te SQL kullanarak dizelerden baştaki ve sondaki boşlukları kaldırma ArcGIS Enterprise, ArcGIS Pro veya ArcMap çalıştıran bir makinede veri tabanı iletişim loglarını kayıt etme ArcGIS Pro’da World Imagery altlık harita meta verilerini görüntüleme ArcGIS Online’da ArcGIS REST API kullanarak bir grup katmanından barındırılan bir detay katmanı nasıl silinir?
Etiketler Güncelleme Güvenlik
Geri Bildirim