Release 3.3.1

Overview:

Build on the foundation of version 3.3.0, this version is mainly targeting security improvements and hardening of the stack by updating all components to their most recent versions. This update will resolve high and critical OWASP CVEs listed below in the Security section.

Majors dependencies upgrades:

• Cassandra driver from 3.x to 4.x

• Tomcat related libraries from 8.x to 9.x

• Spring latest 5.x (5.3.27)

• Spring boot 2.7.11

• Zookeeper client 3.8.1

In terms of functionality, no new major code is introduced, only improvements for the new features introduced in 3.3.0:

• Veridium Admin users can now be connected to Active Directory permissions, offering support for central point user configurations in terms of access

• FIDO enrolments are available again for Android Platform authenticator and Windows 11 TPM authenticator with EC attestation.

• Lost mode is now also available for users that don’t have any other Phone or Hardware Token enroled.

• Improvements in Veridium Manager access permissions for GUI that clean up logs and browser console errors for limited permission accounts.

• Email notifications now contain detailed authenticator names for all scenarios.

• Improved elements' display in various GUI sections to increase readability, correct typos and mitigate overlapping graphics.

• Audit Administrators column translates all SIDs in email addresses for improved readability and tracking.

• URLs containing “-” in their last part are now treated correctly by websecadmin

• Improved permission granularity for limited accounts by introducing View AD details , View location , View UBA info ,View history details, to better comply with privacy regulated scenarios. This is especially helpful in deciding which part of the admin team has access to sensitive data (i.e. Support role can be configured to hide Directory Service Info, Location, UBA or History if it’s not needed)

Security improvements:

Admin CVEs