Release Notes

NSE-62577

The KeySafe 5 UI incorrectly provides an option to disable static module features.

NSE-62874

If an error occurs during a Min-VSN update the HSM mode is not reverted to its original value.

NSE-64436

The KeySafe 5 UI can not browse directly to a certificate using the URL.

NSE-72709

When adding Webhook alert methods to a Trigger via the search, an error may happen when trying to find a match if an existing Webhook is pasted in completely. Instead the value should be entered in manually and then the appropriate suggestion can be selected.

NSE-72656

When trying to save an Agent configuration file, selecting certain cipher suites from the drop down list will result in an invalid agent. This is currently not configurable.

NSE-72609

If a large clock skew event occurs and is corrected, UI visualizations can fail to render. They should reappear once the system has progressed farther than the incorrectly skewed time value.

NSE-72525

The Object Count Alert Type uses the difference between two different OpenMetrics counters. The counters can independently wrap around when they overflow and if this happens, it can fire a false positive alert. When both counters have wrapped around, the difference calculation will be as expected and the false positive alert will be resolved.

NSE-72181

The Transactions graph for HSMs and Hosts can display an anomalous spike. This can be caused by irregular data, perhaps from a resource reset. The graph will return to expected values when the irregular data is outside the scope of the request, either by refreshing the graph or changing the time interval.

NSE-71687

The nShield Edge is not supported in KeySafe 5 for World loading or Upgrade management.

NSE-71678

The loading of security worlds onto a large number of multiple HSMs can time out. If this happens, either go back to the previous page and try again or reduce the number of HSMs for each load request.

NSE-71588

Notifications for resolved Alerts can get missed if a Trigger is edited at precisely the wrong time. This only affects the notifications of resolved and there are no issues with the firing of new Alerts.

NSE-70413

When using 32 bit Firefox in alert configuration and Alert Type is selected all static text is highlighted as mouse is moved over the page. This does not effect the functionality of the page.

NSE-69741

When many (tens of thousands of) files are added to the kmdata/local directory at once, a 'queue or buffer overflow' error may appear in KeySafe 5 agent logs. Restart the KeySafe 5 agent and if the problem persists, remove these files fromm kmdata/local and introduce files to the kmdata/local directory in smaller batches.

NSE-37786

When creating/loading/unloading a Security World on an HSM Pool that contains an nShield Edge HSM, you must manually change the mode of the nShield Edge to Initialization before sending the request.

You should also ensure the HTTP server write timeout in the keysafe5-backend Helm chart is configured to a value that exceeds the time expected to write/read a card on an nShield Edge.

NSE-46785

On Windows machines, any kmdata file created by the nShield KeySafe 5 agent service (for example, a softcard created by KeySafe 5) will not automatically have file permissions to be modified by non-Administrator user accounts.

This means when a local Windows user tries to do an action that wants to overwrite that kmdata file (such as locally changing a softcard passphrase) they will not have permission to rewrite the file in kmdata.

The workaround is for an Administrator user to manually modify the permissions on the kmdata files created by keysafe5-agent to allow local users to modify them.

NSE-51100

KeySafe 5 does not enforce the Remote Administration authorized card list.

Further information can be found in the Release Notes.

NSE-51114

When running the deploy.sh script with DOCKER_REGISTRY set, Docker images can not be pulled from an authenticated Docker registry.

The workaround is to not set DOCKER_REGISTRY and the deploy script will spin up its own registry for use.

NSE-52265

KeySafe 5 can not disable SEE Activation (Restricted) unless all hosts in the HSM Pool are healthy at the time of the disable action.

The workaround is to manually remove the feature enablement certificate files from the host machine.

NSE-56419

KeySafe 5 allows the creation of an SP800-56Ar3 Securirty World using v1.0 Java cards.

Security World creation will complete, but the ACS will be unusable for future operations. Ensure use of v1.1 Java cards prior to creating a Security World with SP800-56Ar3 enabled.

NSE-56722

The FPUI on an nShield 5c does not accurately reflect the HSM mode and the mode banner is not displayed when the HSM mode is changed via KeySafe 5.

NSE-57196

Deletion of a Security World via KeySafe 5 will not persist in the case where a KeySafe 5 agent is enabled on an nShield 5c and that nShield 5c has had world kmdata files synced.

The workaround is to ensure that the nShield 5c kmdata is deleted prior to removing from KeySafe 5.

NSE-64712

As the number of secrets grows in the KeySafe 5 database, operations such as obtaining counts and distinct values can start to fail depending on the CPU & memory resource available to the database server and timeout value set on the connection.

If this occurs the recommendation is to increase the resources available to the database server and increase the database.mongo.socketTimeout value in the backend helm chart.

NSE-65357

When the user is configuring KCM on the KeySafe5 UI, on the token or key selection page, starting on the default 5 items per page and clicking the next button and changing the items per page to a different number causes number of key doesn’t not match to the same items per page. This can be reset by going back to the first page and setting you items back to default.