nShield Security World v13.9.6 Release Notes
Introduction
These release notes apply to the release of version 13.9.6 of Security World for the nShield family of Hardware Security Modules (HSMs).
These release notes contain information specific to this release such as new features, defect fixes, and known issues. They may be updated with issues that have become known after this release has been made available. For the latest version, see https://trustedcare.entrust.com/. Access to the Support Portal is available to customers under maintenance. To request an account, contact nshield.support@entrust.com.
We continuously improve the user documents and update them after the general availability (GA) release. Changes in the document set are recorded in these release notes and are published at https://nshielddocs.entrust.com.
Updated nShield Software Release Policy
Entrust has recently introduced an update to the nShield Software release policy to better define the type of release and the associated update and support policy. As part of this, the concept of Long Term Support (LTS) and Standard Term Support (STS) software releases has been introduced, with each software release being either a LTS or STS release.
For more information on the software release policy, see the nShield Security World Release Information. Alternatively contact https://trustedcare.entrust.com/ for more information.
Purpose of Security World v13.9
Security World version v13.9 introduces new features and enhancements as described in Features of Security World v13.9 STS Release 4. It also corrects a number of defects that have been identified in earlier releases.
|
Security World 13.9.6 is a Standard-Term Supported (STS) release.
This release is designed to give early access to new nShield features and has a shorter support period. For long-term support (LTS), frequent stability updates and certified firmware, it is recommended to use the v13.6 Long-Term Support release. See the nShield Security World Release Information for details of the supported versions and the STS & LTS policy. |
This release contains updates to the following products:
-
Updated Security World Software
-
Updated Codesafe 5 SDK
-
Updated firmware for the nShield 5s
-
Updated firmware for the nShield Solo XC
-
Updated Connect images for nShield 5c and Connect XC
Product versions
Security World software versions
| Version | Date | Description |
|---|---|---|
v13.9.6 |
2026-07-29 |
Full Release of the 13.9.6 Linux and Windows ISOs. |
CodeSafe Developer software versions
| Version | Date | Description |
|---|---|---|
v13.9.6 |
2026-07-29 |
Full Release of the 13.9.6 CodeSafe Linux and Windows ISOs. |
Features of Security World v13.9 STS Release 4
New v13.9.6 Connect Images
Refer to Connect images for more information about the v13.9.6 Connect images.
Refer to Known and fixed issues for more information about fixed issues in the v13.9.6 Connect images.
seeconf keys encryption issue on nShield Connect XC and Solo XC
For nShield Connect XC and Solo XC only:
-
Freshly generated
seeconfkeys for SEE machine encryption created using thegeneratekeyins Security World v13.9 STS Release 4 are not supported by thetct2command. -
seeconfkeys generated in earlier releases can be used to encrypt SEE machiens with no issues when usingtct2. -
There is no impact on loading existing encrypted SEE machines on the XC.
Unset module RTC upgrade issue on Connect 5c units
|
v13.9 images are unaffected by this issue as it is no longer possible to upgrade to a v13.9 image with an unset RTC. An appropriate error will be displayed if the RTC is unset during the upgrade process and the nShield 5c RTC will need to be set to continue with the upgrade. |
|
Connect 5c only Due to NSE-69020 if the nShield 5c unit RTC is not set it will result in an upgrade failure. |
The following nShield 5c images are impacted by NSE-69020:
| Release | nShield 5c Version |
|---|---|
Security World v13.6.3 LTS Release |
v13.6.1 |
Security World v13.6.5 LTS Update 1 |
v13.6.4 |
Security World v13.6.8 LTS Update 2 |
v13.6.7 |
Security World v13.7.3 STS Release 1 |
v13.7.1 |
To determine if your nShield 5c unit has the RTC set correctly, execute the ncdate command against the target nShield 5c unit.
A nShield 5c with the correct RTC date and time set should display a variance of the following:
# ncdate -m1
Local time is 07:03:54.943 2025.03.12An nShield 5c with an incorrect RTC date and time will display the following variance:
# ncdate -m1
Local time is 07:03:54.943 1970.03.12Please contact nshield.support@entrust.com if the RTC for your nShield 5c unit is incorrectly set for more assistance.
FIPS-203 ML-KEM FPGA Acceleration (NSE-64745)
Security World v13.9 STS Release 4 adds FPGA acceleration of ML-KEM encapsulation and decapsulation for high- and mid-speed models using the HY accelerator.
Performance of ML-DSA and other algorithms in the HY accelerator retains the performance from Security World v13.9 STS Release 2.
The same FPGA image (HY) is used for both ML-DSA and ML-KEM. Select it with the same hsmadmin select acceleration command.
|
The It provides two options:
|
CodeSafe 5: Image Encryption (NSE-71648)
Security World v13.9 STS Release 4 adds support for encrypting CodeSafe 5 application images on nShield 5.
Firmware version v13.8.6 or later is required to load encrypted CodeSafe 5 applications.
Image encryption keeps the contents of an application image confidential at rest and in transit, so that the code and any embedded data cannot be inspected outside the HSM.
The image is decrypted inside the HSM when it is loaded, and the decrypted image never leaves the HSM. Signatures are made over the plaintext image and are still verified every time the application starts, so encryption is in addition to image signing, not a replacement for it.
The encryption key is an AES-256 seeconf key created with the generatekey utility, generated module-protected so that encrypted applications can be loaded automatically.
An image is encrypted with AES-GCM either with the new csadmin image encrypt command, or in a single step with signing by passing --enckey to csadmin image sign.
An encrypted image is loaded manually with csadmin load --enckey, or automatically from [codesafe] configuration (or interactively with hsc_codesafe) using the new encryption_key configuration field to specify the ident of the seeconf key.
Encryption with the seeconf key requires certification by a seeinteg key (loading does not, as decryption is protected in the HSM).
It is recommended to use the ASK to certify the seeconf, as that must already be loaded when doing a csadmin image sign operation.
Use of the preload utility is recommended to pin the module for image signing and encryption operations up-front and to avoid having to re-load OCS or re-enter softcard PIN multiple times in a multi-step operation like csadmin image sign which does signing with Developer ID key and ASK, certification of the encryption key and encryption.
Refer to the CodeSafe 5 section of the User Guide for your HSM for the full workflow, including key generation, encryption, and loading.
CodeSafe 5: List and remove certificates on the nShield 5c (NSE-77282)
The nShield 5c appliance-cli gains commands to list and remove the CodeSafe 5 certificates loaded on the appliance.
These are useful when applications are auto-loaded from the 5c configuration and no client has direct access to the csadmin utility on the appliance:
-
appliance-cli -m1 cs5 certlistlists the certificates currently loaded on the appliance. -
appliance-cli -m1 cs5 certremove <serial-number>removes the certificate with the given serial number.
These are the appliance-side equivalents of the client-side csadmin ids list and csadmin ids remove commands.
CodeSafe 5: Runtime environment changes
The sendfile system call is no longer permitted inside the CodeSafe 5 container.
It was allowed from v13.7 but is disallowed again in this release.
Applications that used sendfile should use ordinary read and write calls instead.
Some utilities that were not usable inside the CodeSafe 5 container have been removed from the CodeSafe 5 SDK container root filesystem, reducing the container image size.
The removed utilities are addgroup, adduser, chattr, chroot, crond, crontab, dnsd, getty, halt, hwclock, ifdown, ifup, inetd, klogd, linuxrc, login, makedevs, mdev, mknod, mkpasswd, nameif, readprofile, run-init, runlevel, su, sulogin, syslogd, udhcpc, and uevent.
CodeSafe 5: SDK improvements (NSE-77079)
Security World v13.9 STS Release 4 contains the following improvements and fixes for CodeSafe 5:
-
SDK version information is now added to the log file
-
It is now easier to inspect and compare image hashes for local and running images
-
Refer to Known and fixed issues for more information on fixed CodeSafe 5 issues in Security World v13.9 STS Release 4.
CodeSafe 5: Version and feature compatibility documentation
The CodeSafe 5 FAQ in the User Guide now includes a version and feature compatibility section.
It explains that the HSM firmware and the host-side software (the Security World software, the CodeSafe SDK, and the nShield 5c appliance image) are versioned and signed independently, and that only the PCIe firmware carries FIPS approval. A feature-by-feature table lists the minimum firmware version and the minimum host-side version required for each CodeSafe 5 capability.
The table shows in particular which capabilities remain available on the latest FIPS-approved firmware (v13.4.5) when the host-side software and SDK are updated to a later version. This is intended to help customers who must stay on FIPS-approved firmware but still want to adopt newer host-side tooling.
SSH hybrid post-quantum key exchange by default (NSE-75188)
Security World v13.9 STS Release 4 changes the default SSH key exchange used for the internal, mutually authenticated connection to the nShield 5 nCore API and CodeSafe 5.
The connection now prefers the hybrid post-quantum key exchange mlkem768x25519-sha256, and falls back to ecdh-sha2-nistp256 where the hybrid algorithm is not available, for example against older firmware.
The hybrid exchange mitigates "harvest now, decrypt later" attacks, in which recorded traffic could later be decrypted by a quantum computer.
The hybrid key exchange can introduce a latency spike at rekeying.
If this is a concern, the previous behaviour can be restored by setting NCSSH_KEY_EXCHANGES=ecdh-sha2-nistp256: on Linux add it to /etc/nfast.conf, and on Windows set it as a system environment variable.
The related NCSSH_CIPHERS and NCSSH_MACS variables are documented in the User Guide.
ML-DSA support in JCE (NSE-64738)
Security World v13.9 STS Release 4 introduces ML-DSA key generation, signing, and verification support in the nCipherKM JCE provider.
The following parameter sets defined by FIPS 204 are supported:
-
ML-DSA-44
-
ML-DSA-65
-
ML-DSA-87
Use of ML-DSA requires a firmware version of v13.8 or greater and the PostQuantum feature to be enabled, see the User Guide for your HSM for more information.
See the nCipherKM JCA JCE CSP API Guide for further information on ML-DSA.
SHAKE128 and SHAKE256 MessageDigest support in JCE (NSE-64738)
Security World v13.9 STS Release 4 introduces nCipherKM JCE provider support for the following MessageDigests:
-
SHAKE128
-
SHAKE256
KSD encryption for imported, derived and unwrapped keys (NSE-77279)
Security World v13.9 STS Release 4 introduces PKCS#11 support for KSD wrapping of wrapping keys that are imported or result from a derive or unwrap operation.
nShield Remote Administration GUI update (NSE-63057)
Security World v13.9 STS Release 4 updates the nShield Remote Administration GUI tool to use a new UI toolkit with a reduced installation footprint.
|
On some Linux distributions, you may need to install the |
Open Source Software Updates in Security World v13.9 STS Release 4
Consult the following documents on the ISOs for Open Source Software version information in Security World v13.9 STS Release 4.
| Component | ISO(s) | |
|---|---|---|
nShield 5s |
5s-licenses.pdf |
nShield_HSM_Firmware |
Security World Software |
secworld-licenses.pdf |
SecWorld_Lin64 / SecWorld_Windows |
Security World Software Python Packages |
secworld-python-licenses.pdf |
SecWorld_Lin64 / SecWorld_Windows / nShield_HSM_Firmware |
Deprecated and discontinued features
The following features are deprecated or discontinued in Security World v13.9. If you have been using these features, plan for a new configuration and workflow that does not make use of the feature:
-
KeySafe
This is the legacy Java application. KeySafe 5 continues to be supported in v13.9.
KeySafe information has been removed from the user documentation for v13.9 and later releases. Previous user documentation releases that cover KeySafe continue to be available at https://nshielddocs.entrust.com/.
Firmware images
nShield 5s firmware
The nShield 5s HSM firmware consists of 3 major components:
-
Primary Image
-
Recovery Image
-
Bootloader
The firmware for Security World v13.9 STS Release 4 only updates the Primary image. The Recovery image and Bootloader can be kept at previously released versions.
Details on what the components are used for and how to upgrade the different components are detailed in Upgrade nShield 5s HSM Firmware. Read this section prior to upgrading any nShield 5s.
nShield 5s firmware
| Type | Version | Description | Directory | VSN |
|---|---|---|---|---|
Latest |
13.8.6 |
Firmware with features from the v13.9 STS Release 4. |
|
6 |
|
The VSN for the nShield 5s has been incremented from 5 to 6 in Security World v13.9 STS Release 4. The corresponding firmware package on the Firmware ISO is misnamed. It appears as:
The filename should contain |
Connect images
The nShield firmware and Connect Image ISO includes v13.9.6 Connect images that contain the Solo XC and nShield 5s firmware described in Firmware images.
Install a Connect image
As part of the Security World installation, the /opt/nfast/nethsm-firmware directory is created, but it is empty.
When the Connect image that needs to be installed has been chosen, the subdirectory and the image should be copied from the nShield firmware and Connect ISO into the /opt/nfast/nethsm-firmware directory and installed onto the Connect as usual.
nShield 5c images
| Type | Version | Description | Firmware included | Directory | VSN |
|---|---|---|---|---|---|
Latest |
13.9.6 |
13.9 nShield 5c image with the v13.9 STS Release 4 nShield 5s 13.8 firmware |
13.8.6 |
|
33 |
|
For security reasons the Version Security Number (VSN) of the nShield 5c image has been increased to 33. Upon updating to the new images it will not be possible to downgrade to previous releases. The following releases can be updated to post this change:
|
Connect XC images
| Type | Version | Description | Firmware included | Directory | VSN |
|---|---|---|---|---|---|
Latest |
13.9.6 |
13.9 Connect XC image with the v13.9 STS Release 4 Solo XC 13.8 firmware |
13.8.5 |
|
33 |
|
For security reasons the Version Security Number (VSN) of the nShield Connect XC image has been increased to 33. Upon updating to the new images it will not be possible to downgrade to previous releases. The following releases can be updated to post this change:
|
Upgrade from previous releases
Install 13.9.6 Security World Software
Before installing this release, you must:
-
Confirm that you have a current maintenance contract that licenses you to deploy upgrades on each nShield HSM and corresponding client operating system.
-
Uninstall previous releases of Security World Software from the client machines.
For instructions, see the Installation Guide for your HSM.
Upgrade Solo XC firmware
The following are important notes to observe when upgrading the Solo XC firmware to the latest version:
If the Solo XC HSM is installed with the earlier 3.3.10 firmware it cannot be upgraded directly to the latest firmware and needs to be first upgraded to an intermediate version. Please contact nshield.support@entrust.com and request the firmware upgrade patch from 3.3.10 to 3.3.20.
If the Solo XC HSM is installed with firmware earlier than 12.50.7, 12.50.2, 3.4.2 or 3.3.41 it cannot be upgraded directly to the latest firmware and needs to be first upgraded to an intermediate version. Any of the firmware versions listed above can be used as an intermediate version. Please contact nshield.support@entrust.com for any other version of firmware.
| Whilst every effort is made to ensure Solo XC firmware compatibility with all mainstream hardware and virtualized environments as well as operating systems there may be occasions where a particular configuration is not compatible (either through current version or after upgrading to a newer version of the firmware). Please contact nshield.support@entrust.com if you experience any issues following an upgrade or during integration activity. |
Upgrade nShield 5s HSM Firmware
As detailed in the nShield v13.9.5 HSM User Guide, the nShield 5s HSM firmware consists of 3 major components:
-
Primary Image
-
Recovery Image
-
Bootloader
During normal operation, the nShield 5s is running firmware that is loaded from the Primary image. If required, the nShield 5s can be forced into recovery mode to run firmware loaded from the Recovery image. The main purpose of recovery mode is to allow essential maintenance activities that are not possible when the nShield 5s is running the primary image firmware.
nShield 5s Firmware Version Check
Following the upgrade, the nShield 5s primary image, recovery image and bootloader versions can be checked using the hsmadmin command:
hsmadmin status --json
As an example, following an upgrade, it should report as follows:
"mode": "primary",
"primary-version": "13.8.6-295-14a66c55",
"recovery-version": "13.5.0-0-e2ec16eefd",
"uboot-version": "1.4.1-0-edb84d6e",
Upgrading the nShield 5s Primary & Recovery Image
Upgrade packages may contain updates for any of these components. The same upgrade method is used in all cases. The system will automatically detect which components are included in the update package and will load the firmware to the correct location.
It is not recommended to upgrade both the Primary and Recovery images at the same time. The recommended procedure is to upgrade the Primary firmware first. Test that the system performs as expected and then upgrade the Recovery firmware at a later date.
The primary and recovery images can be upgraded using the following command:
For primary:
hsmadmin upgrade nShield5s-13.8.6-vsn5.npkg --esn module-esn
and for recovery:
hsmadmin upgrade nshield5s-recovery-13-5-0.npkg --esn module-esn
Upgrading the nShield 5s Bootloader
The bootloader is the program that boots the HSM and loads the main application. The nShield 5s has a discrete bootloader that can be updated independently of the Primary and Recovery images.
Pre-Requisites
Whilst the bootloader is an independent part of the firmware, the capability to upgrade the bootloader on the nShield 5s was introduced as part of the Security World v13.4 firmware release. For earlier versions of firmware prior to v13.4, the nShield 5s firmware must be upgraded to v13.4 as a minimum to enable this bootloader upgrade to work. Contact nShield Support for details of obtaining the v13.4 version of firmware.
Upgrading bootloader
Once the primary firmware is at version v13.4 or later, the bootloader can be upgraded using the same hsmadmin upgrade command:
hsmadmin upgrade nShield5s-uboot-1-4-1.npkg --esn module-esn
| Note: Once the bootloader version is upgraded, it is not possible to downgrade the bootloader to the previous version. The Primary and Recovery images can still be downgraded and upgraded independent of this bootloader version. |
Upgrade a Connect XC image
If the Connect XC HSM is installed with image earlier than 12.45, 12.46, 12.50.4, or 12.50.7 it cannot be upgraded directly to the latest Connect image and needs to be first upgraded to an intermediate version. Any of the Connect image versions listed above can be used as an intermediate version. Please contact nshield.support@entrust.com for any other version of Connect image.
Compatibility
Supported hardware
This release is targeted at deployments with any combination of the following nShield HSMs:
-
nShield 5s (Base, Mid, High)
-
Solo XC (Base, Mid, High)
-
nShield 5c (Base, Mid, High)
-
Connect XC (Base, Mid, High, Serial Console)
Supported operating systems
This release has been tested for compatibility with the following operating systems:
| Operating System | Solo XC | nShield 5s | Connect XC, nShield 5c |
|---|---|---|---|
Microsoft Windows 10 x64 |
Y |
Y |
Y |
Microsoft Windows 11 x64 |
Y |
Y |
Y |
Microsoft Windows Server 2022 x64 |
Y |
Y |
Y |
Microsoft Windows Server 2022 Core x64 |
Y |
Y |
Y |
Microsoft Windows Server 2025 x64 |
Y |
Y |
Y |
Red Hat Enterprise Linux 8 x64 |
Y |
Y |
Y |
Red Hat Enterprise Linux 9 x64 |
Y |
Y |
Y |
SUSE Enterprise Linux 15 x64 |
Y |
Y |
Y |
Oracle Enterprise Linux 8 x64 |
Y |
Y |
Y |
Oracle Enterprise Linux 9 x64 |
Y |
Y |
Y |
Security World v13.9.6 support is restricted to the x64 architecture. Additional mainstream x64-based Linux distributions other than those listed above may be compatible, however Entrust cannot guarantee this compatibility.
API support
Supported hypervisors and virtual environments
| Operating System | Solo XC | nShield 5s | Connect XC, nShield 5c |
|---|---|---|---|
Microsoft Hyper-V Server 2016 |
Y |
Y |
Y |
Microsoft Hyper-V Server 2019 |
Y |
Y |
Y |
Microsoft Hyper-V Server 2022 |
Y |
Y |
Y |
Microsoft Hyper-V Server 2025 |
Y |
Y |
Y |
VMWare ESXi 7.0 |
Y |
N |
Y |
VMWare ESXi 8.0 |
Y |
Y |
Y |
Citrix XenServer 8.2 |
Y |
N |
Y |
Supported compilers for Microsoft Windows C developers
Security World v13.9.6 C libraries for Windows were built using Visual Studio 2022 and have been compiled with the SDL flag. This makes them incompatible with older versions of Visual Studio. This applies primarily to static libraries.
Microsoft Windows developers should upgrade to Visual Studio 2022.
| Version | Supported |
|---|---|
2022 |
Y |
Known and fixed issues
| Reference | Scope | Status | Description |
|---|---|---|---|
NSE-78597 |
Client-side |
Resolved |
Addressed an issue where an update to the RHEL 10.2 kernel broke the nShield Solo XC driver installation. Resolved in 13.9 client-side. |
NSE-78191 |
Client-side |
Resolved |
Addressed an issue where the Resolved in 13.9 client-side. |
NSE-77984 |
Client-side and firmware |
Resolved |
Addressed an issue where CodeSafe 5 file processing ignored the Resolved in 13.9 client-side and 13.8 firmware. |
NSE-77954 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-77890 |
Client-side |
Resolved |
Addressed an issue where attempting to import a ML-KEM key using the Resolved in 13.9 client-side. |
NSE-77832 |
Client-side |
Resolved |
Addressed an issue where the CodeSafe outputs did not contain the correct shared object (.so) files. Resolved in 13.9 client-side. |
NSE-77618 |
Client-side |
Resolved |
Addressed an issue where the 5c Resolved in 13.9 client-side. |
NSE-77588 |
Firmware |
Resolved |
Addressed an issue where the FIPS check in Resolved in 13.8.5 (XC) / 13.8.6 (nShield 5) firmware. |
NSE-77424 |
Connect |
Resolved |
Addressed an issue where the Connect unit would not upgrade firmware if build numbers matched. Resolved in 13.9 Connect images. |
NSE-76421 |
Connect |
Resolved |
Addressed an issue where the Connect unit failed to respond correctly to Path MTU Discovery (PMTUD). Resolved in 13.9 Connect images. |
NSE-76078 |
Connect |
Resolved |
Addressed an issue where the Resolved in 13.9 Connect images. |
NSE-75862 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-75763 |
Client-side |
Resolved |
Addressed an issue where the NFKM engine would silently fail if using a stale preload file. Resolved in 13.9 client-side. |
NSE-75671 |
Client-side |
Resolved |
Removed the Resolved in 13.9 client-side. |
NSE-75628 |
Client-side |
Resolved |
Addressed an issue with the help output for the Resolved in 13.9 client-side. |
NSE-75038 |
Client-side |
Resolved |
Addressed an issue where calling C_GenerateKey before C_Initialize would return CKR_ARGUMENTS_BAD. Resolved in 13.9 client-side. |
NSE-75037 |
Client-side |
Resolved |
Addressed an issue where calling functions would segfault if called before C_Initialize. Resolved in 13.9 client-side. |
NSE-75400 |
Client-side |
Resolved |
Addressed an issue where pkcs11extra.h erroneously referenced ML-DSA mechanisms after the 3.2 header adoption. Resolved in 13.9 client-side. |
NSE-74960 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-74499 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-74156 |
Client-side |
Resolved |
Addressed an issue where an assertion would occur when calling Resolved in 13.9 client-side. |
NSE-74125 |
Client-side |
Resolved |
The slotinfo for loadshared slots now includes the Resolved in 13.9 client-side. |
NSE-74083 |
Client-side |
Resolved |
Addressed an issue where Java PublishedSEEWorld’s getInitStatus() method would throw a null pointer exception for already successfully initialized Worlds. Resolved in 13.9 client-side. |
NSE-74078 |
Client-side |
Resolved |
Removed the Resolved in 13.9 client-side. |
NSE-73821 |
Connect |
Resolved |
Refined the Resolved in 13.9 Connect images. |
NSE-73585 |
Client-side |
Resolved |
Refined the error reporting for Resolved in 13.9 client-side. |
NSE-72558 |
Client-side |
Resolved |
Renamed the nCore Resolved in 13.9 client-side. |
NSE-72542 |
Client-side |
Resolved |
Addressed an issue where SEElib_StartProcessorThreads() no longer crashes if nthreads is too high. Resolved in 13.9 client-side. |
NSE-72539 |
Client-side |
Resolved |
Addressed an issue where 'pending job table full' / Status_ObjectNotReady error from SEElib_Transact() no longer occurs when many hundreds of threads are created. Resolved in 13.9 client-side. |
NSE-72508 |
Client-side |
Resolved |
Addressed an issue where a CodeSafe 5 application could crash when C++ threads were used. This was due to the CMake build flags defined in the SDK not including the required flags for correct and consistent C++ builds. If not using CMake to build your CodeSafe 5 application, the C++ compiler and linker flags defined in the SDK’s Resolved in 13.9 client-side. |
NSE-72389 |
Client-side |
Resolved |
Addressed an issue where a Resolved in 13.9 client-side. |
NSE-72241 |
Client-side |
Resolved |
Addressed an issue where objects could leak in the Java CoreKey class. Resolved in 13.9 client-side. |
NSE-72090 |
Connect 5c |
Resolved |
Addressed an issue where new remote client connections to a Connect or 5c would be rejected if the module failed after startup (this did not affect clients that were already connected when the failure occurred). This change supports remote recovery using a privileged client, using "nethsmadmin -r -m1" to reboot the appliance, or (in the case of 5c) using "nopclearfail -r -m1" to attempt to retry after an error (e.g. to clear an SOS code). Note that if an error is cleared without a reboot, it may be necessary to restart the client hardserver (or remove and re-import the 5c using nethsmenroll) in order to reflect the updated state of no longer being Failed. This is not required if the appliance is rebooted instead. Resolved in 13.9 client-side. |
NSE-71960 |
Client-side |
Resolved |
Addressed an issue where 'cnglist --show-sd' would not produce extra information correctly. Resolved in 13.9 client-side. |
NSE-71959 |
Client-side |
Resolved |
Addressed an issue where NTE_NOT_FOUND errors would appear when listing CNG keys verbosely. Resolved in 13.9 client-side. |
NSE-71927 |
Client-side |
Resolved |
Addressed an issue where csadmin image signing can fail when not all modules are usable within the current Security World. Resolved in 13.9 client-side. |
NSE-71923 |
Client-side |
Resolved |
Fixed various issues with Connect XC and Connect 5c units. Resolved in 13.9 client-side. |
NSE-71913 |
Client-side |
Resolved |
Addressed an issue where spurious errors would appear in the CodeSafe 5 logfile from SEEJob processing. Resolved in 13.9 client-side. |
NSE-71851 |
Client-side |
Resolved |
Resolved in 13.9 client-side. |
NSE-71838 |
Client-side |
Resolved |
Fixed various issues with Connect XC and Connect 5c units. Resolved in 13.9 client-side. |
NSE-71732 |
Client-side |
Resolved |
Fixed an issue where the automatic configuration of CodeSafe 5 via [codesafe] config section or the hsc_codesafe tool directly failed to stop existing applications on v13.4 firmware. [codesafe] configuration section and hsc_codesafe tool are now supported with v13.4 firmware when using the latest SecWorld and CodeSafe SDK. Resolved in 13.9 client-side. |
NSE-71688 |
Documentation |
Resolved |
The Security Manual has been updated to state the limitations of the Connect/5c tamper log, and to emphasize the recommendation that Audit Logging should be enabled in new Security World creation as the primary security log mechanism. Resolved in 13.9 documentation. |
NSE-71681 |
Firmware (5s only) |
Resolved |
Addressed an issue where a zero length salt could cause the HSM to fail. Resolved in 13.8.1 firmware. |
NSE-71638 |
Documentation |
Resolved |
Updated the Security Manual to clarify the HSM form factors and the distinction between the Connect/5c appliance and the certified HSM inside it. Resolved in 13.9 documentation. |
NSE-71637 |
Documentation |
Resolved |
Updated the Security Manual to clarify HSM decommissioning steps, especially that factory state is recommended for Connect/5c/5s modules, not just erasure of the Security World. Resolved in 13.9 documentation. |
NSE-71635 |
Connect XC and 5c |
Resolved |
Fixed various issues with Connect XC and Connect 5c units. Resolved in 13.9 Connect Images. |
NSE-71617 |
Connect XC and 5c |
Resolved |
Fixed various issues with Connect XC and Connect 5c units. Resolved in 13.9 Connect Images. |
NSE-71565 |
Connect XC and 5c |
Resolved |
Fixed various issues with Connect XC and Connect 5c units. Resolved in 13.9 Connect Images. |
NSE-71493 |
Client-side |
Resolved |
Addressed an issue where _nfpython3.so in the CodeSafe 5 SDK was not stripped of debug symbols, increasing the CodeSafe 5 container size. Resolved in 13.9 client-side. |
NSE-71420 |
Firmware |
Resolved |
Addressed an issue where Resolved in 13.8 firmware. |
NSE-71350 |
Connect |
Resolved |
Addressed an issue where the Connect unit cannot upgrade from v12.x Connect images. Resolved in 13.9 Connect images. |
NSE-71308 |
Connect |
Resolved |
Fixed an issue where client licenses for 4 clients would not be applied correctly on Connect XC/5c in v13.6 or v13.7 Connect images. This issue is fixed in v13.6.12 (latest v13.6 LTS) and in v13.9 Connect images. Resolved in 13.9 Connect images. |
NSE-71089 |
Firmware |
Resolved |
Addressed an issue to stop accepting elliptic curve domain parameters with certain types of unsupported fields. Resolved in 13.8 firmware. |
NSE-70850 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-70765 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-70686 |
Client-side |
Resolved |
Addressed an issue where the nShield 5s wouldn’t be available for several minutes after a reboot. Resolved in 13.9 client-side. |
NSE-70540 |
Firmware |
Resolved |
Addressed an issue where launcher does not check certificate policies for CS5 intermediate certs. Resolved in 13.8 firmware. |
NSE-70375 |
Firmware (5s only) |
Resolved |
Addressed an issue with EllipticCurve ASN.1 inputs Resolved in 13.8 firmware. |
NSE-70302 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-70283 |
Client-side |
Resolved |
Addressed an issue where 'signextra' with non-FIPS mechanisms gives StrictFIPS140 error on load. Resolved in 13.9 client-side. |
NSE-70255 |
Client-side and firmware |
Resolved |
Resolved in 13.9 client-side and 13.8 firmware. |
NSE-70232 |
Firmware (5s only) |
Open |
While under a prolonged period of heavy load generated by continuous signing or key generation operations using MLDSA 44, the 5s or 5c unit may fail with a Issue first found in 13.8 firmware |
NSE-70194 |
Client-side |
Resolved |
Addressed an issue where harmless operations are not logged if a key has any restrictions. Resolved in 13.9 client-side. |
NSE-70105 |
Client-side |
Resolved |
Addressed an issue where the CodeSafe XC NFKM libraries for GLIBC were missing from the CodeSafe installer. Resolved in 13.9 client-side. |
NSE-70062 |
Client-side |
Resolved |
Fixed an issue where a CodeSafe 5 application would abort if more than 154 jobs were enqueued simultaneously. Resolved in 13.9 client-side. |
NSE-70007 |
Firmware |
Resolved |
Addressed an issue where KCDSA domain validation did not check parameters correctly. Resolved in 13.8 firmware. |
NSE-69976 |
Client-side |
Resolved |
Addressed an issue where generatekey was missing AES import. Resolved in 13.9 client-side. |
NSE-69881 |
Client-side |
Resolved |
Addressed an issue where various PKCS11 functions were not thread-safe. Resolved in 13.9 client-side. |
NSE-69925 |
Client-side |
Resolved |
Addressed various memory leaks in RQCard library. Resolved in 13.9 client-side. |
NSE-69830 |
Client-side |
Resolved |
Addressed an issue where ch_checkkey() didn’t reject non-FIPS keys in FIPS mode. Resolved in 13.9 client-side. |
NSE-69623 |
Firmware |
Resolved |
Addressed RSA length inconsistencies. Resolved in 13.8 firmware. |
NSE-69523 |
Client-side |
Resolved |
Addressed small memory leaks in C_Initialize, when run against a FIPS level 3 enforced Security World. Resolved in 13.9 client-side. |
NSE-69520 |
Client-side |
Resolved |
Fixed an issue on Windows where perfcheck called the deprecated Windows wmic tool, which may no longer be installed, to query CPU information for its report. Resolved in 13.7 client-side. |
NSE-69503 |
Client-side |
Resolved |
Addressed an issue where the signers_transact() was broken in CodeSafe 5 Developer examples. Resolved in 13.9 client-side. |
NSE-69326 |
Client-side |
Resolved |
Addressed an issue where sendcerts permits groups below the ciphersuite’s minimum. Resolved in 13.9 client-side. |
NSE-69076 |
Client-side |
Resolved |
Improved the CodeSafe 5 crash reporter so that some information would be provided even when a full backtrace was not available. Resolved in 13.7 client-side. |
NSE-69053 |
Client-side |
Resolved |
Addressed an issue where the nShield 5s driver failed to report the version in dmesg. Resolved in 13.9 client-side. |
NSE-69048 |
Client-side |
Resolved |
Added missing Resolved in 13.9 client-side. |
NSE-69020 |
Connect |
Resolved |
Addressed an issue where the Connect 5c upgrade will fail to upgrade if the time is not set on the module. Refer to Unset module RTC upgrade issue on Connect 5c units for more information. Resolved in 13.9 Connect images. |
NSE-68919 |
Client-side |
Resolved |
The csadmin tool is now strict by default in requiring that the "launcher" service on the HSM has an attestation certificate. This certificate is only available in v13.5 and later firmware (and a factory state may be required to generate it if it is not present). If using a firmware version without support for attestation certificates (such as v13.4), the NC_SSH_ATTEST_CERT or NC_SSH_ATTEST_<esn> environment variables can be set in the environment of the csadmin tool to control the behaviour if there is a missing certificate. It can be set to IGNORE (connection proceeds silently), WARN (previous behavior prior to this change), or FAIL (connection will fail, new behavior). Setting NC_SSH_ATTEST_CERT=WARN or NC_SSH_ATTEST_CERT=IGNORE is suggested if using v13.4 firmware. It is recommended that factory state be done if necessary to generate the certificate if using v13.5 or later firmware if it is currently absent. Resolved in 13.9 client-side. |
NSE-68682 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-68675 |
Client-side |
Resolved |
Addressed some performance and scheduling issues. Resolved in 13.9 client-side. |
NSE-68534 |
Firmware |
Resolved |
Addressed an issue where legacy key-migration mistakes could lead to an inability to carry out further key-migration. Resolved in 13.8 firmware. |
NSE-68179 |
Client-side |
Resolved |
Fixed an issue on Windows where an unwanted message box could appear relating to the TVD driver installation during a Security World software or Remote Administration software installation. Resolved in 13.7 client-side. |
NSE-68093 |
Firmware |
Resolved |
Addressed performance issues with CodeSafe 5 administration operations. Resolved in 13.8 firmware. |
NSE-68044 |
Client-side |
Resolved |
Addressed an issue where the csadmin utility failed to include the scope ID when reporting link-local addresses. Resolved in 13.7 client-side. |
NSE-68007 |
Client-side |
Resolved |
Fixed an issue where incorrect parameters in client nCore commands (like wrong module number) were unnecessarily reported as errors in the hardserver log. Resolved in 13.7 client-side. |
NSE-67930 |
Client-side |
Resolved |
Fixed an issue where CodeSafe 5 CSEE (SEElib) applications could fail with SIGPIPE in some cases. Resolved in 13.7 client-side. |
NSE-67913 |
Firmware |
Resolved |
Addressed an issue with service restrictions and permissions. Resolved in 13.8 firmware. |
NSE-67846 |
Client-side |
Resolved |
Fixed an issue where the nShield Audit Service could fail to correctly resume handling the export and expiry of system logs where an interruption had occurred during export on a previous run. Resolved in 13.7 client-side. |
NSE-67839 |
Client-side |
Resolved |
Addressed an issue where DHPrivate 'xlength' checking is not exact. Resolved in 13.9 client-side. |
NSE-67776 |
Firmware |
Resolved |
Addressed an issue where the Resolved in 13.8 firmware. |
NSE-67758 |
Firmware |
Resolved |
Addressed an issue where the firmware would provide incomplete validation error messages in response to the Resolved in 13.8 firmware. |
NSE-67601 |
Firmware |
Resolved |
Addressed an issue where the incorrect BIOS code would be reported when the VCM would fail to start in single-tenant mode. Resolved in 13.7 firmware. |
NSE-67579 |
Client-side |
Resolved |
Fixed an issue where output from nshieldaudit when printing to stdout rather than to file was not in JSON format as intended. Resolved in 13.7 client-side. |
NSE-67248 |
Client-side |
Resolved |
Addressed an issue where the auditlog spooler service would log every 5 minutes when unconfigured. Resolved in 13.9 client-side. |
NSE-66919 |
Client-side |
Resolved |
Addressed an issue where Resolved in 13.9 client-side. |
NSE-66905 |
Documentation |
Resolved |
The documented set of allowed CodeSafe 5 system calls now reflects the set of system calls allowed by seccomp. Resolved in 13.7 documentation. |
NSE-66800 |
Client-side |
Resolved |
Addressed an issue where some client-side CodeSafe developer libraries were shipped as source code rather than built as libraries. Resolved in 13.9 client-side. |
NSE-66437 |
Connect |
Resolved |
Made the Connect CLI command Resolved in 13.7 Connect images. |
NSE-66432 |
Connect |
Resolved |
Addressed an issue with Resolved in 13.7 Connect images. |
NSE-66415 |
Open |
The appliance-cli gethsmstatus command returns a 'Failed to retrieve status' error when executed against Legacy FIPS Connect image. This means the version information for the Legacy FIPS Connect image cannot be retrieved at this time. Issue first found in 13.6 |
|
NSE-66256 |
Client-side |
Resolved |
Addressed an issue where the message "Failed to parse last log data from current log" would be displayed in the nshieldauditd logfile. Resolved in 13.7 client-side. |
NSE-66232 |
Firmware |
Resolved |
Addressed a firmware issue which prevented CodeSafe 5 applications built with 13.4 SDK from working on later versions of firmware. Applications built with 13.4 SDK will work on 13.7 and later firmware, but they cannot run on 13.5 firmware which does not have this fix. Resolved in 13.7 firmware. |
NSE-65799 |
Client-side |
Resolved |
Addressed an issue where a stack trace would be displayed during installation on SLES12 platforms. Resolved in 13.7 client-side. |
NSE-65310 |
Client-side |
Resolved |
Addressed an issue where encryption with CKM_AES_CTR in PKCS#11 failed if used with a token key that had not been loaded on the module. Resolved in 13.9 client-side. |
NSE-65292 |
Firmware |
Resolved |
Addressed an issue where a Status_Failed message would occur instead of Status_DecryptFailed with RSAUnwrap and AES Key unwrapping under certain circumstances. Resolved in 13.7 firmware. |
NSE-65229 |
Firmware |
Resolved |
Addressed an issue where DeriveMech_PublicFromPrivate doesn’t work with Ed448Private. Resolved in 13.7 firmware. |
NSE-65109 |
Firmware |
Resolved |
Addressed an issue where the Solo XC was too enthusiastic to clear the module from the clear button. Resolved in 13.7 firmware. |
NSE-64992 |
Client-side |
Resolved |
Addressed an issue where the Resolved in 13.7 client-side. |
NSE-64885 |
Client-side |
Resolved |
Addressed an issue where the CONNECTION ERROR: Unable to connect to 'monitor' failure would occur when multiple clients were attempting to connect to the monitor service. Resolved in 13.7 client-side. |
NSE-64592 |
Documentation |
Resolved |
Addressed an issue where the M_AESmGCM HTML docs omitted the ciphertext format. Resolved in 13.7 documentation. |
NSE-64625 |
Client-side |
Resolved |
Addressed an issue where HSM Pool Mode would not work in PKCS #11 with a v13 client-side and older v12 firmwares. Resolved in 13.9 client-side. |
NSE-64570 |
Client-side |
Resolved |
Resolved in 13.9 client-side. |
NSE-64525 |
Client-side |
Resolved |
Addressed an issue where nfkmverify didn’t accept keys which could perform ECIES unwrapping. Resolved in 13.9 client-side. |
NSE-64438 |
Firmware |
Resolved |
Addressed an NVMWearLevel issue for Solo XC and nShield 5s units. Resolved in 13.7 firmware. |
NSE-64409 |
Client-side |
Resolved |
Fixed an issue which prevented later CodeSafe SDKs from running on v13.4 firmware. Rebuilding application with the latest CodeSafe SDK will enable it to run on v13.4 firmware. This re-enables support for applications written in C. For Python support, the v13.4 CodeSafe SDK must continue to be used with v13.4 firmware. Newer CodeSafe SDK is supported on v13.5 and later firmware in all cases. Resolved in 13.9 client-side. |
NSE-64304 |
Client-side |
Resolved |
Addressed an issue where D3S certificates appear in ncoreapi’s stderr. Resolved in 13.9 client-side. |
NSE-63892 |
Client-side |
Resolved |
Addressed an issue where generated nCore HTML pages could be missing. Resolved in 13.7 client-side. |
NSE-63502 |
Open |
When using KeySafe5 with the agent on the Connect the following error will populate the logs 'Command failed: monitor codesafestats get-all'. Users should increase the codesafe_update_interval using the ks5agent command via the Connect CLI. ks5agent cfg codesafe_update_interval=48h If you wish the logs to be cleared then enabling the Audit tooling will expire the system logs containing the above error. Issue first found in 13.6 |
|
NSE-63449 |
Client-side |
Resolved |
Addressed an issue in PKCS#11 where the following error would be reported: 'Key generation certificate with no private/secret key?' Resolved in 13.7 client-side. |
NSE-63444 |
Client-side |
Resolved |
Addressed an issue in PKCS#11 where confusion between nShield and PKCS#11 key type enum values could cause a 'NFBER_Encode_Octet_BitStr_Key failed for len' error. Resolved in 13.7 client-side. |
NSE-63091 |
Client-side |
Resolved |
Fixed an issue where the C_GetAttributeValue return value could be overwritten. Resolved in 13.9 client-side. |
NSE-62984 |
Client-side |
Resolved |
Addressed an issue in Resolved in 13.9 client-side. |
NSE-62533 |
Client-side |
Resolved |
Addressed an issue in PKCS#11 where SELinux would prevent CodeSafe 5 applications from binding on some ports. Resolved in 13.7 client-side. |
NSE-62267 |
Client-side |
Resolved |
Addressed an issue where multiple hardware failures could occur on Edge units. Resolved in 13.9 client-side. |
NSE-61967 |
Client-side |
Resolved |
Addressed an issue where the tar utility would be killed by seccomp when used within a CodeSafe 5 application. Resolved in 13.7 client-side. |
NSE-61966 |
Client-side |
Resolved |
An issue has been fixed where, if a CodeSafe 5 application created files on its local disk, 'csadmin destroy' reported an error when trying to remove those files. Resolved in 13.9 client-side. |
NSE-61540 |
Client-side |
Resolved |
Addressed an issue where the CS5 Compatibility Layer would not stay listening for incoming connections. Resolved in 13.7 client-side. |
NSE-61148 |
Firmware |
Resolved |
Addressed an issue where the init log is not created by replacement Python code as it should be. Resolved in 13.7 firmware. |
NSE-61033 |
Firmware (5s only) |
Resolved |
Addressed an issue where deprecated options were reported in the nShield 5s system logs. Resolved in 13.7 nShield 5s firmware. |
NSE-60936 |
Firmware |
Resolved |
Addressed an issue where CodeSafe can lose trace data. Resolved in 13.7 firmware. |
NSE-60779 |
Client-side |
Resolved |
Fixed an issue where the nShield 5c would fail to Factory State if the nShield 5s system log was full. Resolved in 13.9 Connect images. |
NSE-60554 |
Client-side |
Resolved |
Addressed an issue where TUAK and Milenage session key generation performance had decreased due to the need to generate key generation certificates at the point of key generation. This has been resolved by adding a new PKCS#11 environment variable: CKNFAST_SESSION_TO_TOKEN, this is enabled by default. The default behaviour is to generate session keys without Key Generation Certificates. This can be disabled by setting CKNFAST_SESSION_TO_TOKEN=0. Resolved in 13.7 client-side. |
NSE-59598 |
Client-side |
Resolved |
Fixed an issue where RQCard used in conjunction with nflog could cause a segmentation fault. Resolved in 13.9 client-side. |
NSE-59584 |
Client-side |
Resolved |
Addressed an issue where it wasn’t possible to generate a CodeSafe 5 CSR using the Resolved in 13.9 client-side. |
NSE-59281 |
Client-side |
Resolved |
Addressed an issue where CodeSafe developer id certificates can be issued for RSA keys and the issued RSA keys can now sign images. Resolved in 13.9 client-side. |
NSE-57030 |
Client-side |
Resolved |
On Linux, the sshadmin client key for nShield 5s is now backed-up automatically to /root/.ssh/id_nshield5_sshadmin as a precaution against /opt/nfast/services/client directory being deleted. This backup is restricted to the local machine by default. It is recommended on both Windows and Linux to backup the sshadmin key if using nShield 5s. If it may be necessary to move the HSM to a different machine (or to reinstall the OS) at a later stage, the key should be backed up with the "hsmadmin keys backup --passphrase" option so that it is protected by a passphrase rather than being restricted to the local machine and OS installation. Resolved in 13.9 client-side. |
NSE-55780 |
Open |
Starting a CodeSafe 5 application on an nShield 5c produces the message "Could not find nshield network interfaces for service discovery" in the verbose output. Issue first found in 13.4 |
|
NSE-55428 |
Open |
Building classic CodeSafe examples fails with older compiler. Issue first found in 13.4 |
|
NSE-55425 |
Firmware |
Resolved |
Addressed an issue where 'Unable to perform operation due to service interdependency lock' was reported when using the Resolved in 13.7 firmware. |
NSE-55378 |
Open |
Minor inconsistency when enabling autostart via csadmin config. |
|
NSE-55142 |
Open |
From 13.4 keys generated using ckrsagen will now produce a warning using nfkmverify, this is due to stricter policy enforce on unwrap permissions. To overcome this use CKA_UNWRAP_TEMPLATE when generating PKCS#11 keys. Issue first found in 13.4 |
|
NSE-55136 |
Client-side |
Resolved |
Fixed an issue where offline produced CodeSafe 5 image signatures would fail CreateSEEConnection. Resolved in 13.9 client-side. |
NSE-53090 |
Client-side |
Resolved |
Fixed an issue where using Resolved in 13.9 client-side. |
NSE-52456 |
Firmware (5s only) |
Resolved |
Addressed an issue where hsmadmin settime would leave the module around 2 seconds behind the host. Resolved in 13.7 nShield 5s firmware. |
NSE-52302 |
Firmware (5s only) |
Resolved |
Addressed an issue with impath command sanitization. Resolved in 13.8.1 firmware. |
NSE-50848 |
Client-side |
Resolved |
Fixed an issue where Resolved in 13.9 client-side. |
NSE-50050 |
Client-side |
Resolved |
Fixed an issue where the Resolved in 13.9 client-side. |
NSE-49263 |
Client-side |
Resolved |
Fixed an issue where Resolved in 13.9 client-side. |
NSE-48991 |
Client-side |
Resolved |
Addressed an issue where nfkmutils.loadkey did not support softcards. Resolved in 13.7 client-side. |
NSE-43472 |
Client-side |
Resolved |
Addressed various issues with nfkmutils.loadkey. Resolved in 13.7 client-side. |
NSE-42031 |
Firmware (XC only) |
Resolved |
Addressed a gradual increase in memory usage on nShield Solo XC modules. Resolved in 13.7 nShield Solo XC firmware. |
NSE-41205 |
Firmware (XC only) |
Resolved |
An issue has been fixed that can cause a Solo XC or Connect XC HSM to enter an SOS state after many days of running. The issue would have generally manifested as an SOS-HV or SOS-HRTP, but other SOS codes are possible. A number of "SpiRetries" as reported by stattree utility may precede the failure. Resolved in 13.7 nShield Solo XC firmware. |
NSE-48073 |
Open |
Connect+ models running software earlier than v12 must first be upgraded to a v12 version before being upgraded to v13. See section Upgrade from previous releases for more details. Issue first found in 13.3 |
|
NSE-42017 |
Connect |
Resolved |
Fixed various issues with Connect XC and Connect 5c units. Resolved in 13.9 Connect images. |
NSE-39031 |
Open |
In Security World v12.10 a compliance mode was added to the Connect to allow compliance with USGv6 or IPv6 Ready requirements. Issue first found in 12.80 |
|
NSE-38156 |
Client-side |
Resolved |
Addressed an issue where Linux SNMP install depended on the Resolved in 13.9 client-side. |
NSE-36086 |
Client-side |
Resolved |
Addressed an issue where OpenSSH did not enable TCP_NODELAY resulting in latency spikes in CodeSafe 5 communication. Resolved in 13.7 client-side. |
NSE-35974 |
Firmware |
Resolved |
Addressed an issue where Resolved in 13.8 firmware. |
NSE-73249 |
Firmware |
Resolved |
Addressed an issue where files written by a CodeSafe 5 application within its container became inaccessible after a reboot of the HSM.
Note that application files must be written to the Resolved in 13.8.4 firmware. |
NSE-35520 |
Client-side |
Resolved |
Addressed an issue where the Resolved in 13.9 client-side. |
NSE-32255 |
Client-side |
Resolved |
Addressed an issue where the Resolved in 13.9 client-side. |
NSE-28606 |
Open |
Entrust do not recommend migrating keys to non-recoverable worlds since it would then be impossible to migrate the keys in future should the need arise. If keys are migrated into a non-recoverable world then it is not possible to verify OCS and softcard protected keys directly with nfkmverify. The OCS or softcards must be preloaded prior to attempting to verify the keys. |
|
NSE-26829 |
Client-side |
Resolved |
Addressed an issue where the reserved C++ keyword Resolved in 13.9 client-side. |
NSE-25401 |
Open |
When installing 12.60 on a Dell XPS 8930 PC, a "Files in Use" screen may be displayed where it prompts to close down and restart Dell, Intel and NVIDIA applications. This can be ignored. Issue first found in 12.60 |
|
NSE-24335 |
Open |
This issue applies to 12.50.11 XC firmware only. As a result of work to improve the upgrade experience with Solo XC it is necessary to add the following lines to /etc/vmware/passthru.map for successful operation of Solo XC in an ESXi environment: # Solo XC 1957 082c link false Issue first found in 12.50 |
|
NSE-24026 |
Client-side |
Resolved |
Addressed an issue where the Resolved in 13.9 client-side. |
NSE-23982 |
Open |
While resetting password if user enters incorrect password, cli prompt prints lone "I". This is where login handler program would print "Incorrect password for cli" message. Only "I" gets through the wire in time due to slow baud rate of the connection. This error is trivial and is only seen at the first log in during password reset. Issue first found in 12.50 |
|
NSE-23332 |
Client-side |
Resolved |
Addressed confusing help message when calling Resolved in 13.9 client-side. |
NSE-22692 |
Client-side |
Resolved |
Addressed an issue where the Resolved in 13.9 client-side. |
NSE-22484 |
Client-side |
Resolved |
Addressed an issue where the Resolved in 13.9 client-side. |
NSE-14406 |
Open |
In the Connect config file the remote_sys_log config entry implies multiple entries can be defined but only one remote syslog server can be configured. Issue first found in 12.50 |
|
NSE-8568 |
Client-side |
Resolved |
Addressed an issue on Linux platforms where the Resolved in 13.9 client-side. |
NSE-7446 |
Client-side |
Resolved |
Addressed an issue where the PKCS#11 CMAC output length was wrong. Resolved in 13.9 client-side. |
NSE-4551 |
Client-side |
Resolved |
Addressed an issue where unregistering the CNG providers using the Resolved in 13.9 client-side. |