Changelog

Replace babel/polyfill with core-js 3 (foundation-2021 branch) (Issue NMS-16477)

Test case failures org.opennms.features.newts.converter. numeric value is NaN (Issue NMS-16936)

Logging in TcpListener in Eventd is done with a foreign class (Issue NMS-16951)

Need to Update the Example Event Forwarder Script (Issue NMS-16501)

Unable to display varbind’s form feed characters and other control characters in events (Issue NMS-16395)

LdapMonitor does not work when a Minion is the poller (Issue NMS-16349)

VMware credentials exposed in provisiond log file (Issue NMS-16357)

Zookeeper 3.4.6 version mismatch in Meridian 2021 (Issue NMS-16209)

Add debug logging to SNMP Property Extenders on match failure (Issue NMS-15743)

Surveillance Dashboard shows acknowledged Alarms (Issue NMS-15448)

Users with ROLE_READONLY can add, modify, and delete alarm memos (Issue NMS-16162)

Integrate hibernate-core related patch from Debian (Issue NMS-16181)

Version bump of json for CVE-2023-5072 (Issue NMS-16191)

login.jsp page is still visible/accessible after being authenticated by pre-authentication (Issue NMS-14078)

SENTINEL_HOME points to wrong location in fix-permissions (Issue NMS-16159)

Prevent Angular evaluation of strings enclosed by two curly braces in non-Angular form-fields and output (Issue NMS-15504)

Polling fails when rrd-status is set to true (Issue NMS-15806)

Back-port Angular evaluation prevention in non-Angular fields to foundation-2020 (Issue NMS-16052)

Prevent Invalid Node Filter Search from revealing SQL query (Issue NMS-16057)

Update Instrumentation Log Reader to parse IPv6 addresses (Issue NMS-16114)

backport fixes from Spring Security 5.x to custom Spring Security 4.2.20.RELEASE (Issue NMS-15663)

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users (Issue NMS-15703)

Stored XSS in multiple JSP files in opennms/opennms (Issue NMS-15782)

Reflected XSS in multiple JSP files in opennms/opennms (Issue NMS-15783)

CVEs for postgresql JDBC driver 42.2.18 (Issue NMS-15861)

OpenNMS Search Bar does not retrieve nodes without foreignsource and foreignid (Issue NMS-16030)

Error on startup with Invalid CEN header exception (Issue NMS-16034)

Disable BeanShell interpreter remote server mode (Issue NMS-15793)

Inconsistent references to JMXCollect/Monitor for "password-clear"/"password_clear" (Issue NMS-14884)

https redirection is partially broken (Issue NMS-15732)

Add /usr/lib64/jvm to find-java.sh search paths (Issue NMS-15784)

Polling fails when rrd-status is set to true (Issue NMS-15806)

This release has moved to a newer major version of Spring Security to address a number of CVEs, which necessitated changes to the $OPENNMS_HOME/jetty-webapps/opennms/WEB-INF/applicationContext-spring-security.xml file, so if you have modified this file in your installs, be sure to note your changes so you can re-apply them to the updated version.

The script $OPENNMS_HOME/bin/install checked whether $myser equals $RUNAS before sourcing $OPENNMS_HOME/etc/opennms.conf, which caused startup to fail every time unless the script were run as root; if you have patched that file on your system, watch out for a .rpmsave or .dpkg-new file.

Multiple CVEs for Axis 1.4 (Issue NMS-15061)

eventd does not validate its configuration before reloading in response to a reloadDaemonConfig event (Issue NMS-15289)

Fixing typo for event uei.opennms.org/internal/schedOutagesChanged (Issue NMS-15421)

Event Datetime element parsing changed between M2018 and M2021 (Issue NMS-15471)

Backshift graph’s Data tab shows incorrect / phantom data when using STACK (Issue NMS-15495)

install script checks for equality of myuser and RUNAS before sourcing opennms.conf (Issue NMS-15610)

send-events-to-elasticsearch karaf command passes username/password in reverse (Issue NMS-15638)

backport spring-security updates from NMS-15506 to Meridian 2020 (Issue NMS-15662)

Meridian Minion 2023 and 2022 installation docs for RHEL 8/9 use the repo URL for 2021/rhel8 (Issue NMS-15665)

Doc: File name syslog-grok-patterns.txt is wrong (Issue NMS-15684)

Stop packaging activemq-web-console.war (Issue NMS-15686)

Database deadlock caused by JdbcFilterDao (Issue NMS-15696)

Bring back URL deep-linking (Issue NMS-15414)

backport event search fixes (NMS-12517 and NMS-14918) to foundation-2020 (Issue NMS-15679)

POW Arithmetic Operator Does not work with Backshift Graphing Engine (Issue NMS-14779)

Cacheable HTTPS Responses - Cache Control Directive Missing or Misconfigured (Issue NMS-14936)

Plaintext Password Present in the Web logs (Issue NMS-15305)

Syslog Northbounder maxMessageSize config option is not used (Issue NMS-15606)

Jetty CVE-2023-26048/CVE-2023-26049 (Issue NMS-15612)

Update to latest groovy 2.x (Issue NMS-15633)

$OPENNMS_HOME/etc/THIRD-PARTY.txt has gone missing with Horizon 31.0.6 and onwards (Issue NMS-15636)

SNMPv3 support for AES256 appears broken (Issue NMS-15637)

Enable AmbientCapabilities=CAP_NET_RAW CAP_NET_BIND_SERVICE in shipped opennms.service systemd file (Issue NMS-15596)

Scriptd consumes CPU even when it does nothing (Issue NMS-13216)

dependabot: upgrade Apache POI to at least 4.1.1 (CVE-2019-12415) (Issue NMS-14589)

POW Arithmetic Operator Does not work with Backshift Graphing Engine (Issue NMS-14779)

Multiple CVEs for cxf 3.2.8 (Issue NMS-15065)

Concurrent requests to rrd summary endpoint fails (Issue NMS-15086)

Statistics Reports → Export Excel fails with exception (Issue NMS-15148)

The various SNMP extenders to not work with ifIndex-indexed resources (Issue NMS-15342)

SNMP Interfaces Endpoint returns multiple values [duplicates] when there are multiple "IP Interfaces" pointing to same SNMP-IfIndex "ipAdEntIfIndex". (Issue NMS-15352)

Missing XML Validation in Apache Xerces2 (Issue NMS-15373)

M2022 Minions > 2022.1.8 Cannot use SCV credentials (Issue NMS-15450)

Event Datetime element parsing changed between M2018 and M2021 (Issue NMS-15471)

upgrade Xalan to 2.7.3 (CVE-2022-34169) (Issue NMS-15578)

Vulnerable c3p0 0.9.1.1 packaged in Meridian 2021 (Issue NMS-15072)

re-enable license maven plugin as a separate job (Issue NMS-15572)

Upgrade ActiveMQ to 5.15 (Issue NMS-12089)

dependabot: mockito 3.4.6 to 4.6.1 (Issue NMS-14586)

PersistRegexSelectorStrategy is not where the docs say it should be (Issue NMS-15461)

Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) (Issue NMS-14865)

Document the breaking changes done as part of Limit script file locations for GpDetector and ScriptPolicy (Issue NMS-15288)

The GpDetector and ScriptPolicy now require that their scripts be located beneath $OPENNMS_HOME and beneath $OPENNMS_HOME/etc/script-policies, respectively. If you are using either of these classes in your foreign-source definitions, please address this requirement before upgrading to this release.

Thanks to researcher Baharuddin Zulkifli of NetbyteSEC for reporting several cross-site scripting vulnerabilities.

Thanks to researcher Stefan Schiller of SonarSource for reporting a pair of authenticated command-injection vulnerabilities.

The release notes for Meridian-2022.1.12 incorrectly stated that NMS-15124 was fixed in that release. In actual fact, the fix is in this release (Meridian-2022.1.13).

Multiple stored and reflected XSS in webapp (Issue NMS-14854)

reloading BSM daemon causes the state of serviceProblem alarm to be reset (Issue NMS-15124)

CVE-2017-7504 for javassist 3.18.2-ga and 3.19.0-ga (Issue NMS-15191)

CVE-2017-7504 for jboss-logging 3.1.0.cr2 (Issue NMS-15192)

CVE-2019-13990 for quartz 2.2.3 (Issue NMS-15194)

CVE-2022-45047 for sshd-sftp 2.5.1 (Issue NMS-15195)

CVE-2021-21342 and 7 others for xstream 1.4.11.1 (Issue NMS-15196)

CVE-2014-9970 for jasypt 1.9.0 (Issue NMS-15197)

CVE-2021-33813 for jdom2 2.0.6 (Issue NMS-15198)

CVE-2022-40149 and CVE-2022-40150 for jettison 1.3.8 (Issue NMS-15199)

CVE-2016-5725 for jsch 0.1.51 (Issue NMS-15200)

CVE-2022-3171 for protobuf-java 3.16.1 (Issue NMS-15201)

CVE-2018-17187 for proton-j 0.14.0 (Issue NMS-15202)

CVE-2017-15288 and CVE-2020-7907 for scala-library 2.11.0 and 2.12.12 (Issue NMS-15203)

CVE-2020-13936 for velocity 1.7 (Issue NMS-15204)

CVE-2020-11988 for xmlgraphics-commons 1.4 (Issue NMS-15205)

Plaintext Password Present in the Web logs (Issue NMS-15305)

CVE in Jolokia 1.3.3 dependency (Issue NMS-15068)

CVE-2021-37714 for jsoup (multiple versions) (Issue NMS-15069)

vulnerable Junit dependency (Issue NMS-15074)

JAVA_KEYALIAS Variable needs to be updated (Issue NMS-15239)

JAVA_KEYSTORE Variable needs to be updated (Issue NMS-15240)

JAVA_STOREPASS Variable needs to be updated (Issue NMS-15241)

Document the breaking changes done as part of Limit script file locations for GpDetector and ScriptPolicy (Issue NMS-15288)

Uncontrolled Resource Consumption in Jackson-databind (Issue NMS-15030)

Change OpenNMS Copyright from 2022 to 2023 (Issue NMS-15211)

reloading BSM daemon causes the state of serviceProblem alarm to be reset (Issue NMS-15124)

Notifd auto-ack function does not use meta data (Issue NMS-13020)

Map Pins Missing Since Upgrade (Issue NMS-13918)

javadoc not being generated in H31 (Issue NMS-14750)

Regression: install script fails if an OpenNMS directory contains root-owned lost+found directory (Issue NMS-14919)

Form Autocomplete Attribute Not Set (Issue NMS-14934)

Cookie Attribute - SameSite Attribute Missing or Misconfigured (Issue NMS-14937)

Events and alarms search return error 405 POST method not allowed (Issue NMS-15031)

opennms rpm could get wrong jetty files (Issue NMS-15043)

RHEL9/CentOS9/Rocky 9 need chkconfig package to enable service properly (Issue NMS-15093)

Dependabot: leaflet from 1.7.1 to 1.8.0 (Issue NMS-14584)

Update Debian/Ubuntu Upgrade Instructions (Issue NMS-15087)

dependabot: Upgrade PostgreSQL dependency to 42.4.3 (or higher) (Issue NMS-15095)

RPM packages fail to install when FIPS Enabled (Issue NMS-14628)

Upgrade AngularJS to latest 1.x (Issue NMS-14715)

Apache Log4j 1.x Multiple Vulnerabilities (PB-2022, Sep 2022) (Issue NMS-14818)

Database reports need to be rebranded (Issue NMS-14058)

backport Guava 25 changes to foundation-2022 (Issue NMS-14565)

Unexpected interfaceDown event/alarm during a scheduled outage (Issue NMS-14695)

Debian/Ubuntu gpg deprecation warning (Issue NMS-14760)

Invalid redirect when behind a reverse proxy (Issue NMS-14805)

Scheduled scan fails to inform nodeScanAborted events (Issue NMS-14853)

Sonarcloud coverage for foundation-2022 (Issue NMS-14759)

Changes to package-lock.json causes eslint to be not found (Issue NMS-14943)

Move Enlinkd daemon docs to Reference section (Issue NMS-14913)

Duplicate V3 trap security names causing spurious errors on non V3 traps (Issue NMS-14718)

Kafka Producer NPE causes collection failure overall (Issue NMS-14740)

Flow docs don’t account for default config (Issue NMS-14749)

Update BSM Documentation (Issue NMS-8571)

Trapd is missing in the docs (Issue NMS-12629)

Determine if requisitions docs are correct (Issue NMS-13938)

Back-port multi-constraint work (Issue NMS-14698)

Reflected XSS (PB-2022, Aug 2022) (Issue NMS-14713)

Browser-Specific XSS (PB-2022, Aug 2022) (Issue NMS-14714)

Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) (Issue NMS-14716)

Session Cookie (Authentication Related) Does Not Contain The "HTTPOnly" Attribute (Issue NMS-14717)

Add style guide content to the documentation (Issue NMS-14654)

Rest API v2 for obtaining a list of SNMP interfaces doesn’t return back node id (Issue NMS-14449)

Open JDK Package References in Upgrade Documentation (Issue NMS-14682)

Event / Alarms filtering no longer works (Issue NMS-14542)

change or remove how Docker SSH keys are generated (Issue NMS-14643)

Graph page doesn’t escape <> in resource labels (Issue NMS-14657)

PassiveStatusd (Issue NMS-8567)

Provisiond (Issue NMS-8569)

Please update the copyright year on the docs page! (Issue NMS-13911)

Upgrade dom4j to latest version (Issue NMS-14696)

Change OIA name to OpenNMS Plugin API (Issue NMS-14475)

Remove footer content from opennms/docs (Issue NMS-14637)

Migrate Notification wiki pages into docs (Issue NMS-13584)

show-event-config displays unexpected content after adding new event definitions (Issue NMS-12863)

Clearing an alarm brings alarm not found message (Issue NMS-12981)

JVM MemoryPool data collection not working (Issue NMS-14041)

Scripts invoke sudo even if running as root (Issue NMS-14410)

Documentation references invalid docker version for latest horizon version release (Issue NMS-14431)

WebMonitor does not track the response time (Issue NMS-14535)

Grafana dashboard reports do not run (Issue NMS-14544)

Fix docs references to editing org.apache.karaf.features.cfg (Issue NMS-14566)

Spring Framework CVE-2022-22950 Remediation (Issue NMS-14568)

EventTranslator Daemon Documentation (Issue NMS-8566)

Add KPIs for CPU count and memory size to datachoices telemetry (Issue NMS-14482)

Document allowed characters in service-names (Issue NMS-14423)

JDBCQueryDetector documentation (Issue NMS-14453)

JDBStoredProcedureDetector documentation (Issue NMS-14454)

Update PG installation documentation to use SCRAM (Issue NMS-13057)

Update Events Documentation (Issue NMS-14212)

Migrate Trap configuration wiki to docs (Issue NMS-14323)

Document SNMP oid varbind pattern matching and varbind expansion to create unique events (Issue NMS-14346)

SNMP Interface Poller doc updates (Issue NMS-14412)

Update documentation for policy matching (Issue NMS-14528)

simplify assembly tarballs (Issue NMS-14572)

Correct Grammar in Notices Box (Issue NMS-12355)

Error responses are not handled correctly when handling ElasticSearch responses (Issue NMS-13785)

Link in ERROR log doesn’t exist (Issue NMS-13956)

Event/Alarm advanced search not passing search terms (Issue NMS-14161)

Heatmap drill down does not show any alarms/outages (Issue NMS-14243)

Replace old logo references in some files/reports with the new logo (Issue NMS-14372)

runas=root entry in opennms.conf gets duplicated (Issue NMS-14396)

Notification with Destination Path and Group, Interval Delay doesnt show (Issue NMS-14403)

Kafka Consumer stops commits when overloaded (Issue NMS-14415)

event nodeCategoryMembershipChanged should be more verbose (Issue NMS-10634)

There should be documentation for the reports (Issue NMS-11810)

Authentication related WEB-INF files should also exist in etc-pristine (Issue NMS-13834)

Add support for pre-authorization via HTTP header (to be used with pre-authentication) (Issue NMS-14059)

upgrade JNA to 5 (Issue NMS-14417)

[Web] - WebServer Fingerprinting (Issue NMS-13987)

Telemetryd does not shut down gracefully (Issue NMS-14003)

Users with ROLE_USER face Access Denied when accessing Resource Graphs from Reports Section (Issue NMS-14193)

Exception when searching assets (Issue NMS-14240)

Rogue opennms-tools/phonebook/pom.xml (Issue NMS-14266)

Remove "Commercial Support" ticket lookup from web ui support section (Issue NMS-14280)

Circle ci caching OIA issue (Issue NMS-14291)

Kafka-Producer Alarm Resync Failing Post Entire Kafka Cluster Outage (Issue NMS-14321)

Add a note to remember delete the browsers cache when upgrading OpenNMS (Issue NMS-8504)

there is no documentation on the instrumentation log reader (Issue NMS-10393)

LoopMonitor & detector (Issue NMS-11042)

Document PassiveServiceMonitor (Issue NMS-11052)

WmiMonitor (Issue NMS-11065)

Migrate External Auth into docs (Issue NMS-13574)

Document how to set up SSL with Jetty (Issue NMS-13684)

Document how to upgrade OpenNMS (Issue NMS-13692)

DCB: Error reporting needs love (Issue NMS-14128)

Be able to control label sizes for the stress-metrics command (Issue NMS-14194)

Add new KPIs to datachoices telemetry (Issue NMS-14203)

Correct errors on Business Service Monitoring docs (Issue NMS-14337)

Snmp Link Up does not clear Snmp Link Down (Issue NMS-14378)

install script fails if an OpenNMS directory contains root-owned lost+found directory (Issue NMS-14032)

Provisiond Fails to Start when wrong data is successfully POSTed via REST to hardwareInventory endpoint (Issue NMS-14085)

Grafana box renders raw JS when Grafana behind reverse proxy with SSO (Issue NMS-14109)

CVE-2022-22965: Spring RCE in Data Bindings (Issue NMS-14134)

Minions Trapd Listener Fails to Bind to udp/162 when broker is down (Issue NMS-14148)

Fix formatting in alarmd documentation (Issue NMS-14182)

Dependabot: update Vaadin to the latest 8.x (Issue NMS-14192)

Upgrade groovy-all dependency (Issue NMS-14208)

make sure license-maven-plugin is re-enabled in foundation and release branches (Issue NMS-14217)

Upgrade jackson-mapper-asl dependency (Issue NMS-14252)

Basic upgrade procedure (Issue NMS-13971)

Document housekeeping tasks before upgrade (Issue NMS-13972)

Cleanup Ticketer docs formatting (Issue NMS-14172)

Expand XmlCollector documented parameters (Issue NMS-14256)

Restructure Collector docs file path (Issue NMS-14258)

Documentation for all pollers misses RRD config parameter (Issue NMS-11747)

Enlinkd API response extremely slow for some nodes (Issue NMS-13507)

Resolve SonarCloud High priority Security Hotspots (Issue NMS-14002)

Can’t set capabilities in Minion systemd unit (Issue NMS-14016)

Scriptd helpers ignore community setting (Issue NMS-14045)

Wrong wiki URL in debian installer (Issue NMS-14053)

Build from source documentation needs a minor correction (Issue NMS-14088)

Hostname command is missing when running in a container (Issue NMS-14100)

Fix for NMS-13887 did not make it to Core (Issue NMS-14117)

Update docs for binding ports <1024 (Issue NMS-14162)

Switch to using a java e-mail library instead of system mail (Issue NMS-14015)

Expand newts converter documentation (Issue NMS-14073)

Add TcpDetector documentation (Issue NMS-14074)

Misspelling in SystemExecuteMonitor error text (Issue NMS-14091)

relicense rancid-api to LGPL, change dependency to match (Issue NMS-14093)

clean up JAXB dependencies (Issue NMS-14105)

Upgrading opennms ignores RUNAS when setting ownership on logs directory (Issue NMS-14000)

OpenNMS points to the wrong URL when trying to generate graphs (Issue NMS-14057)

opennms user credentials wrongly exposed (Issue NMS-12146)

Install script fails when using Azure PostgreSQL Services (Issue NMS-13715)

In default installation the ActiveMQ Total Enqueued Messages throw divde error exceptions (Issue NMS-13737)

Systemd startup uses legacy SysV init script (Issue NMS-13783)

Telemetryd error occurring when testing with hsflowd (Issue NMS-13795)

OpenNMS Availability 'Chart' Shouldn’t Include Time Before Connected (Issue NMS-13822)

Support → System Report exposes credentials in plain text (Issue NMS-13831)

Cross site scripting - Reflected (Issue NMS-13835)

TLS: Diffie-Hellman Key Exchange Insufficient DH Group Strength Vulnerability (Issue NMS-13845)

Password field with autocomplete enabled (Issue NMS-13847)

fix-karaf-setup.sh should honor RUNAS (Issue NMS-13881)

Remote RMI is broken in 29.0.x (Issue NMS-13887)

Unable to modify node/interface/service metadata through requisition after initial synchronization (Issue NMS-13890)

Web UI redirects to http even with base-url set to https (Issue NMS-13901)

Minion fails to marshall requisition with JAXB error: Class [org.opennms.netmgt.model.PrimaryTypeAdapter] not found (Issue NMS-13927)

Prevent REST API from allowing multiple primary SNMP interfaces on a single node (Issue NMS-13939)

Unsynchronized access to service factories in TelemetryServiceRegistryImpl (Issue NMS-13961)

Instrument Provisiond Thread Pools (Issue NMS-13969)

SNMP Detector configuration page excludes useSnmpProfiles and ttl options (Issue NMS-13997)

install script fails if an OpenNMS directory contains root-owned lost+found directory (Issue NMS-14032)

Upgrade protobuf-java version (Issue NMS-13889)

Releases should document third party libraries and their licenses (Issue NMS-14004)

Delete BSM window should name the BSM (Issue NMS-14026)