Release notes 2.10.3#

Product

EclecticIQ Platform

Release version

2.10.3

Release date

15 November 2021

Summary

Patch release

Upgrade impact

Medium

Time to upgrade

~18 minutes to upgrade an instance with 4 million entities.

  • From the previous release

  • Using the installation script

  • For an instance running on one machine

Additional ~6 minutes to run pre-upgrade scripts for upgrading from 2.8.x and earlier.

Time to migrate

  • PostgreSQL database: ~6 minutes per 4 million entities

  • Elasticsearch database: ~1 minute per 4 million entities

  • Neo4j database: ~1 minute per 4 million entities.

Upcoming#

  • EclecticIQ Platform to be renamed EclecticIQ Intelligence Center

    2.10 is the last release using the EclecticIQ Platform name. As of release 2.11 we will rename the product to EclecticIQ Intelligence Center and update all documentation.

Important bug fixes#

  • Browsers unable to display graphs because of issues with Keylines library

    KeyLines 5.10.3 and earlier had an issue that caused graphs to not display on Chrome 93 and browsers based on it (e.g., Microsoft Edge 93). This is fixed by upgrading KeyLines to 5.10.4.

Known issues#

  • Elasticsearch 7 encounters “Data too large” errors: See Known issue with Elasticsearch 7: “Data too large”.

  • Entity incorrectly warns it is outdated: When viewing an entity, the entity may warn that it is not the latest version when it actually is. This is related to an issue where with attachments that have been depulicated multiple times, causing issues in the final state of the entity.

  • When you configure the platform databases during a platform installation or upgrade, you must specify passwords for the databases.

  • Systemd splits log lines exceeding 2048 characters into 2 or more lines.

    As a result, log lines exceeding 2048 characters become invalid JSON, causing Logstash to be unable to parse them correctly.

  • When more than 1000 entities are loaded on the graph, you cannot load related entities and observables by selecting Load entities, Load observables, or Load entities by observable from the context menu.

  • When creating groups in the graph, it is not possible to merge multiple groups into one.

  • If an ingestion process crashes while ingestion is still ongoing, data may not always sync to Elasticsearch.

  • Users can leverage rules to access groups that act as data sources, even if those users are not members of the groups they access through rules.

  • Running multiple outgoing feed tasks may cause the platform to consume a large amount of memory over time, because certain outgoing feeds such as HTTP download must load the data into memory in order to make it available to feed consumers.

Known issue with Elasticsearch 7: “Data too large”#

Since release 2.9.0, the platform comes bundled with Elasticsearch (ES) 7.9.1. ES 7 adds a new real memory circuit breaker that causes ES nodes to respond with a circuit_breaking_exception error when it detects that memory use has reached 95% of the totally available JVM heap.

Because of this change, you may encounter issues related to available memory where previously at the same workloads, ES would appear to run smoothly.

If your plaform is encountering issues related to Elasticsearch responding with a circuit_breaking_exception error, you can do the following to mitigate:

Increase available memory for ES#

The circuit_breaking_exception error occurs only when ES detects that you are about to go over a memory use threshold that would cause it to fail.

Increase the amount of memory available to ES, or move it to its own host where it does not compete with the platform for resources to keep your ES nodes running.

Security issues and mitigations#

To see a detailed list of security issues and their mitigations, go to All security issues and mitigations.

ID

CVE

Description

Severity

Status

Affected versions

EIQ-2021-0014

-

Users with only modify workspaces permissions can add or remove collaborators on a workspace they have access to

1 - LOW

Clock Planned for 2.11.0

2.10.x and earlier.

EIQ-2021-0013

-

Users with only modify entities and read files permissions can access and export attachments from report entities they do not have access to.

2 - MEDIUM

Clock Planned for 2.11.0

2.10.x and earlier.

EIQ-2021-0012

-

Users with only modify tickets and read ticket-comments permissions can modify properties of a task object they can access to move and see task comments from tasks they should not have access to.

2 - MEDIUM

Clock Planned for 2.11.0

2.10.x and earlier.

EIQ-2021-0011

-

Users without direct assignment to a listed workspace can view details they should not see.

1 - LOW

Clock Planned for 2.11.0

2.10.x and earlier.

EIQ-2021-0010

-

Users with only modify files permissions can move files from their workspace to other workspaces they don’t have access to.

2 - MEDIUM

Clock Planned for 2.11.0

2.10.x and earlier.

EIQ-2021-0009

-

Users with only modify ticket-comments and read tickets permissions can edit and delete comments on a Task they are at least a stakeholder on.

2 - MEDIUM

Clock Planned for 2.11.0

2.10.x and earlier.

EIQ-2021-0007

-

Users could create entities in Source Groups indirectly assigned through Groups, instead of only being able to create entities in Groups they are directly assigned to.

1 - LOW

Tick 2.10.1

2.10.0 and earlier.

EIQ-2021-0007

-

Users could create entities in Source Groups indirectly assigned through Groups, instead of only being able to create entities in Groups they are directly assigned to.

1 - LOW

Tick 2.9.2

2.9.1 and earlier.

EIQ-2021-0006

-

SVG file upload could allow cross-site scripting (XSS)

2 - MEDIUM

Tick 2.9.2

2.9.1 and earlier.

EIQ-2021-0005

-

HTML injection through the GUI

2 - MEDIUM

Tick 2.9.2

2.9.1 and earlier.

EIQ-2021-0004

CairoSVG is vulnerable to regular expression denial of service

2 - MEDIUM

Tick 2.10.0

2.9.1 and earlier.

EIQ-2021-0003

PySAML2 improper verification of cryptographic signature

2 - MEDIUM

Tick 2.10.0

2.9.1 and earlier.

EIQ-2021-0002

Pillow is vulnerable to buffer overflows

2 - MEDIUM

Tick 2.10.0

2.9.1 and earlier.

Download#

For more information about setting up repositories, refer to the installation documentation for your target operating system.

EclecticIQ Platform and dependencies for CentOS and RHEL

Note

The platform dependencies URL for versions 2.9 and later is https://downloads.eclecticiq.com/platform-dependencies-centos-2.9/. It contains packages that are incompatible with versions 2.8 and earlier.

EclecticIQ Platform extensions

Upgrade#

The following diagram describes the upgrade path you should take depending on the platform version you are upgrading from.

For example:

  • You can upgrade from version 2.9.1 of the platform to 2.10.0 directly,

  • To upgrade from 2.4.0 to 2.10.0, you must first upgrade to 2.5.0, then upgrade from 2.5.0 to 2.10.0.

When upgrading from 2.8.x and earlier to 2.9.x and later:

  • You must run the pre-upgrade script to allow it to work with Elasticsearch 7.9.1.

  • You must run the pre-upgrade script on the platform version you are upgrading from.

    For example, when upgrading from 2.8.0 to 2.10.1, you must run the pre-upgrade script on the platform while it is running version 2.8.0.

Upgrade diagram

Upgrade diagram#

From 2.5.0, the upgrades paths have been tested using the EclecticIQ Platform install script compiled by Rundoc.

The script only supports:

  • Single machine installs.

  • Instances installed using the platform install script.

and does not support platform instances installed in distributed environments.