Please pay special attention to the issues below before you begin an upgrade to this ECS Connection Manager release.

Generation of 4096-bit DHE Key

During an upgrade to this version of ECS Connection Manager from a version prior to 7.2.53.0, a new 4096-bit DHE key is generated. On smaller ECS Connection Manager, this can lead to significant CPU and memory consumption that could impact regular virtual service traffic. So, Kemp strongly recommends that this update be performed in a maintenance interval. 

Best Practices Cipher Set

In version 7.2.52.0, the BestPractices cipher set was updated. If you are upgrading from a version prior to 7.2.52.0, this change is effective immediately after upgrade to this release. This change was made to improve ECS Connection Manager security and conform to the latest industry best practices.

It is recommended, however, that you migrate your services as soon as possible to use the new BestPractices cipher set. For more information on the cipher suites removed from the set, please see the ECS Connection Manager 7.2.52.0 Release Notes.

Supported Models for Upgrade

This release of ECS Connection Manager is supported on the Hardware and Virtual models shown in the first three columns of the table below. 

Upgrade Patch XML File Verification Notes

By default, verification of the digital signature on upgrade images is required in version 7.2.50.0 and above. See the Update Verification Options setting under System Administration > Miscellaneous Options > WUI Settings. If the unit you are upgrading is set to require validation, you'll need to supply the XML Verification File supplied with this release.

Note that:

• In previous releases, two verification files were provided: one for pre-7.2.51 systems and one for later systems. This restriction has been removed with the 7.2.53.0 release; if upgrading from firmware 7.2.51.0 and above you can use the XML file provided with this release. If upgrading from any other firmware version please read the release notes for that specific ECS Connection Manager firmware version.

Downgrading to Earlier Versions

Downgrading am ECS Connection Manager running 7.2.56.0 to 7.2.51.0 (or a later release) can be performed using any desired Update Verification Options setting.

Downgrading to version 7.2.50.0 or a previous release can only be done when the Update Verification Options setting is set to Optional or Legacy. When performing the downgrade, do not specify an XML file. If you want to verify the digital signature on the image before downgrading, you can do so using a manual process documented on the support website.

Security Updates

CVE-2022-0778

This patch updates the default OpenSSL libraries to Version 1.1.1n to address the OpenSSL security vulnerability described in CVE-2022-0778. In summary, this exploit leverages an internal OpenSSL bug that can cause an infinite loop to occur when parsing certificates. As a result, parsing a client certificate with an elliptic curve public certificate (or a public certificate with explicit elliptic curve parameters) may trigger the infinite loop and thus a denial of service attack. Further details are in the vulnerability database entry at the link above.

Note that this patch does not update the earlier version of OpenSSL present on ECS Connection Manager (Version 1.0.2) to address CVE-2022-0778. This earlier OpenSSL version is used only when the Certificates & Security >SSL Options > OpenSSL Version parameter is set to Use older version. If this is set to Use current version (the default value), then OpenSSL 1.1.1 is used.

Fortunately, with OpenSSL 1.0.2, there is no vulnerability to this exploit during the SSL handshake because of the handshake design in OpenSSL 1.0.2. On Connection Manager, the vulnerability can only be exploited by an administrative Connection Manager user who installs a specially crafted certificate and public key, and therefore presents a much lower risk of exposure to this vulnerability. This issue will be addressed in a future release.  

Existing Known Issues

<FQDN>:794 Uncaught ReferenceError: disp_addrr_elements is not defined
    at <FQDN>:794
(anonymous) @ <FQDN>:794