Overview 

The release of version 2024.4 includes new features, enhancements, and crucial bug fixes. This release focuses on improving user experience, security, and overall system performance. Below is a quick overview of the items delivered.

New Features

1. Group Assignment for Multiple Users from UI

With this User & Group management feature, you can select more than one native Cerberus user on the UI and assign a (primary) group to all of them at once.

Prior to this release, the primary group assignment for each native user should be done one by one. Now, you can achieve multi-user group assignments in a single go. For more information on this feature, please visit our blog on primary group assignment for multiple users.

2. UI Upgrade with Bootstrap 5-based Style and JavaScript Libraries:

The Cerberus Web Client is now enhanced and more secure with the advanced features provided by Bootstrap 5 libraries. For more details, please refer to our blog on the web client UI upgrade.

3. Scheduling of Scan a Folder for Remote Folder:

Cerberus users can now scan a remote (SFTP Remote System) folder using the “Scan a Folder” scheduled task. To know details about the existing functionalities of scanning a folder, please refer to Version 13: Folder Scanning Events.

Security Improvements

• Penetration Testing: Addressed a few security issues on HTTP headers. 
• SAST Findings: Addressed stack-based buffer overflow and integer overflow or wraparound vulnerabilities found by SAST scan.
• cURL library is upgraded to the latest version (8.11.0)
•  jquery.validate upgraded to version 1.21.0.
• TLS Server Key Pair Message: Updated to provide more informative messages.

Bug Fixes

1. SSO User and Group Custom Mappings:  

We have resolved the issue where the group list in the SSO User and Group Custom Mappings dialogs was displayed in reversed alphabetical order and limited to 1000 elements. The list is now correctly ordered in ascending order and displays all groups.

Additionally, we have fixed the issue related to group membership in Microsoft Entra. Deleting a member from a group no longer causes group membership issues.

2. Maximum Length on ECDSA Key Pair: Ensured to put the right message on how much maximum key length we support while dealing with ECDSA key pairs.

3. HTTP Response Header Injection: Addressed the reported vulnerability.

4. URL Injection Vulnerability: Fixed the vulnerability reported on URL Injection.

Performance Testing

We conducted extensive stress testing, including high-volume simulations of user creation and file management. These tests verified that your file transfer processes will now execute reliably with improved resource management.