13.6. What’s Fixed in 7.7.0

This section describes bugs fixed in Observability Framework 7.7.0. These are fixes since 7.6.0.

Connext 7.7.0 is the first production release in the 7.7 long-term support (LTS) series. It is built upon and combines all of the features in releases 7.4.0, 7.5.0, and 7.6.0 (see Previous Releases). See the Connext Versions and Lifecycle page for more information on RTI’s software release model.

For what’s new and fixed in other products in the Connext suite, see those products’ release notes on the RTI Community Portal or in your installation.

Note

Some fixes relevant to Observability Framework are documented in the RTI product where the fix was applied. See also the release notes for the Core Libraries and Admin Console.

[Critical]: System-stopping issue, such as a crash or data loss.
[Major]: Significant issue with no easy workaround.
[Minor]: Issue that usually has a workaround.
[Trivial]: Small issue, such as a typo in a log.

13.6.1. [Critical] Collector Service could crash if application periodic data received before application event *

Collector Service must receive metric labels before it can export periodic metric data. When periodic data was received before the application event containing the required labels, Collector Service could crash. Now, Collector Service correctly ensures labels are received before attempting to export metric data.

[RTI Issue ID OCA-455]

13.6.2. [Major] Collector Service did not delete application event queues from WebSocket event handler when application removed *

The Collector Service WebSocket adapter event handler manages application queues to schedule the processing of application resource events; the service failed to delete these queues, resulting in memory growth. Now, Collector Service correctly deletes these queues.

[RTI Issue ID OCA-449]

13.6.3. [Minor] Collector Service could not use builtin QoS profiles when configured to skip default files

When the Collector Service configuration file contained QoS profiles with references to builtin profiles, and the ignore_default_files field was set to {{TRUE}}in the ServiceProperties, Collector Service failed to parse the QoS profile.

[RTI Issue ID OCA-456]

13.6.4. [Minor] RTI Collector Service sent samples that should have been discarded to the endpoints *

The Collector Service (used by RTI Observability Framework and RTI Admin Console) processes samples upon receipt, prior to transmission to the endpoint. Previously, the Collector Service failed to discard these samples appropriately, resulting in their transmission to the endpoints instead of their proper disposal. Now, the Collector Service correctly discards the samples.

[RTI Issue ID OCA-451]

13.6.5. Vulnerabilities

The following vulnerabilities are fixed in this release.

See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.

13.6.5.2. [Critical] Potential stack buffer overflow in Collector Service when parsing malicious XML

Collector Service could have been affected by a vulnerability found in the Libxml2 third-party library (rtixml2 in Connext). This issue has been resolved by upgrading to a newer version of the third-party library. See the third-party software upgrades in What’s New.

13.6.5.2.1. User Impact without Security

A vulnerability in the rtixml2 library could have resulted in the following:

13.6.5.2.2. User Impact with Security

A vulnerability in the rtixml2 library could have resulted in the following:

[RTI Issue ID OCA-452]

13.6.5.3. [Critical] Potential unauthorized local file system read in Collector Service when parsing a malicious XML configuration document

Improper restriction of an XML external entity reference vulnerability in Collector Service when parsing a malicious XML configuration document could allow unauthorized local file system read access and Data Serialization External Entities Blowup.

13.6.5.3.1. User Impact without Security

A vulnerability in Collector Service while loading configurations via XML could have resulted in the following:

13.6.5.3.2. User Impact with Security

Same impact as described in “User Impact without Security” above.

[RTI Issue ID OCA-457]



* This bug does not affect you if you are upgrading from 7.3.x or earlier.