Version 12.0 Release Notes

Version 11.x Release Notes

Version 11.3.7 Official Release — 5/17/2021

• Fixed: Duplicate folders when AD user is assigned to multiple groups with the same virtual directories
• Fixed: Missing file and directory upload browser button icons on mobile devices
• Fixed: Cerberus terminates due to unhandled exception
• New: SCP preserve timestamps option for file uploads

Version 11.3.6 Official Release — 4/21/2021

• Fixed: Cerberus contained a privilege escalation vulnerability from loading a DLL from a non-privileged path
• Fixed: In HTTP/S web client, users cannot download a folder or file with a percent sign in the name
• Fixed: Upgraded to curl 7.76.1

Version 11.3.5 Official Release — 4/7/2021

• Fixed: Cerberus contained a privilege escalation vulnerability from loading an OpenSSL configuration file from a non-privileged path
• Fixed: Upgraded to curl 7.76.0 to address security vulnerabilities
• Fixed: Cerberus crashed when Report Manager has a bad database configuration and sending a session report email
• Fixed: Memory leak when encrypting/decrypting data
• Fixed: Cisco Unified Communications Manager cannot send backups to Cerberus via SFTP when FIPS is enabled
• Fixed: Cisco hardware cannot upload via SCP and fails with error message
• Fixed: SFTP clients failed key exchange when the server or the client sent an initial key exchange packet and incorrectly guessed the algorithm the other side was using
• Fixed: HTTP/S web client and Event Manager cannot unzip zip files that are not entirely consistent
• Fixed: In HTTP/S web client, users that double-click on a directory can reach an inconsistent state and an incorrect breadcrumb

Version 11.3.4 Official Release — 3/9/2021

• New: In Server Manager, there is now an option to control exclusive upload file locking for SSH SFTP version 4 and lower
• New: Upgraded to curl 7.75.0

Version 11.3.3 Official Release — 2/23/2021

• New: Improved performance for customers with many client connections per second and authenticating with native Cerberus users
• New: In User Manager, improved search performance when there are many users
• New: When viewing a selected user account, User Manager now allows creating a new group in addition to selecting an existing group
• Fixed: Addressed OpenSSL security vulnerabilities with patches for CVE-2021-23839, CVE-2021-23840, CVE-2021-23841
• Fixed: Upgraded to jQuery validation 1.19.3 to address security vulnerabilities
• Fixed: Cannot access Cerberus Desktop GUI when cookie support is disabled
• Fixed: Cerberus Desktop GUI showed many errors when the “HTTP/S Web Admin Session Timeout” value was very low
• Fixed: Cerberus did not consistently timeout Web Administration sessions
• Fixed: In Server Manager, HSTS cannot be set on HTTP/S Admin listeners
• Fixed: In Report Manager, the log showed numerous errors when using SQL Server 2012
• Fixed: In User Manager, users and groups with special characters did not display correctly
• Many minor bug fixes and improvements

Version 11.3.2 Official Release — 1/21/2021

• New: On the Advanced tab of Server Manager, Cerberus now allows enabling experimental beta features
• New: Active Directory Users page allows native-like administration and mapping changes for AD users (beta feature)
• New: LDAP Users page allows native-like administration and mapping changes for LDAP users (beta feature)
• New: Cerberus now provides more logging when repairing a corrupted stats.dat file
• New: User Manager now allows the revocation of a public share from the context menu
• New: Server Manager now allows admins to force users’ browsers to reload HTTP/S Web Client static resources instead of loading cached versions
• Fixed: Cerberus Desktop GUI is slow or unresponsive after updating to version 11.3.1
• Fixed: Cerberus crashed when SFTP clients sent an invalid SFTP packet
• Fixed: LDAP search results failed to find users when there are more than 1000 users
• Fixed: When disabling FIPS 140-2, Server Manager did not display a warning that Cerberus needs to be restarted
• Many minor bug fixes and improvements

Version 11.3.1 Official Release — 12/15/2020

• New: Cerberus now uses KeyPair’s FIPS 140-2-validated cryptographic module with Certificate #3503
• New: In Server Manager, Cerberus now allows a configurable value for the Web Administration session timeout
• New: In the Interfaces window, Cerberus now displays more detailed security-related feedback and messages for each listener.
• New: User Manager now allows searching users by their first and last names
• New: User Manager now displays the date a user was created
• New: Web Administration now shows the labels for SMTP servers to more easily differentiate between multiple servers
• New: Report Manager now warns when an unsupported ODBC driver is selected
• Fixed: Addressed OpenSSL security vulnerabilities with patches for CVE-2020-1971 and CVE-2020-1968
• Fixed: Upgraded to curl 7.74.0 to address curl security vulnerabilities
• Fixed: Cerberus passed sensitive values in URLs that could expose them to people with access to server and application logs
• Fixed: Cerberus crashed when server certificate and private key are missing and SSL/TLS is enabled
• Fixed: Cerberus failed to verify an LDAP server without manually entering the correct password on the Binding Options page
• Fixed: In Report Manager, Cerberus logs errors when writing audit records for administrator actions to a MySQL database
• Fixed: Users could not enable 2FA even though they are required to do so because “Allow 2 Factor” had not been checked
• Fixed: Users cannot login because User Manager allowed admins to set the invalid state in which “Require Password Change on Login” is checked but the user is not allowed to change their password
• Fixed: Report Manager cannot connect to SQL Server database when the database name includes a hyphen
• Many minor bug fixes and improvements

• New: User Manager now has a “horizontal” layout to reduce the amount of scrolling when administering native users and groups
• New: Usability improvements to Extension Blocking in User Manager
• New: The Summary page now warns when a certificate is expiring or has expired
• New: The Summary page now warns when remote host certificate verification is disabled
• New: In Server Manager, admins can now customize the issuer name to something other than “Cerberus” when using OTP for two-factor authentication
• Fixed: Cerberus did not enforce password history policy for web administrator accounts
• Fixed: In web administration and web client, Cerberus allowed a malicious actor to spoof content with misleading messages designed to trick users
• Fixed: In web administration and web client, browsers may store pages in the user’s browser cache that could be accessible to a malicious actor on a public computer, a shared system, or a machine in a semi-public area.
• Fixed: In web administration, Cerberus disclosed passwords or other sensitive data in an unmasked format in the HTTP response
• Fixed: In Report Manager, the log showed numerous errors when using SQL Server Express LocalDB 2012
• Fixed: Enhanced log filtering only filtered the first IP address and ignored any additional filters
• Many minor bug fixes and improvements

• Fixed: Updated to the latest version of MomentJS to address a vulnerability to regular expression denial of service
• Fixed: HTTP/S web client localization allowed language translations that could include malicious JavaScript
• Fixed: Cerberus crashed when HTTP/S web client served a file with a timestamp in which the year is more than 3000
• Fixed: In the log, Cerberus sometimes attributed system tasks to users
• Fixed: When uploading via SCP, some SCP clients showed the transfer as failed even though the transfer was successful
• Fixed: In SOAP API, GetGroupInformation always returned empty “sshOptions”
• Fixed: Sync Manager added a new server entry instead of updating the existing entry when editing the IP address
• Authentication for Active Directory users now only queries users using a legacy API if “Try Alternative Active Directory Check” is enabled
• In web administration and web client, Cerberus now creates intermediate directories when creating directories
• Cerberus now supports DUO Federal for two-factor authentication
• Report Manager now creates a database index on the ‘files’ table for MySQL/MariaDB
• User Manager now sets the Last Login value for a cloned user account to be “Unknown”
• Other minor bug fixes and improvements

• Fixed: Cerberus crashed when HTTP clients request invalid ranges
• Fixed: Cerberus crashed when loading certificates from an invalid PFX file
• Fixed: LDAP user was not able to change password when LDAP configuration has SSL enabled
• Fixed: Memory leak in Cerberus Desktop GUI
• Fixed: In Event Manager, Session Report email did not render correctly in MS Outlook
• In web administration, tables did not remember settings for number of rows per page
• Other minor bug fixes and improvements

• New: Report Manager now supports the PostgreSQL database
• Fixed: Extension blocking did not reject prohibited file extensions from being uploaded with SCP
• Fixed: Log Manager did not show the time in the local time format
• Fixed: In Event Manager, Logoff Event rules with Email Session Report action could only select Default Email Server even though there are multiple SMTP servers
• Fixed: In Report Manager, Cerberus failed to generate a File Report when using SQL Server 2008 R2 as the database

• Fixed: Cerberus crashed when an FTP client uploads a file using MODE Z compression
• Fixed: When running as an application (as opposed to running as a Windows Service), Cerberus did not verify remote host certificates
• Fixed: Cerberus could not verify valid remote host certificates because of expired certificates in the OS trust store
• Fixed: Event Manager did not trigger a Directory Created Event when a dragging and dropping a folder in the HTTP/S web client
• Fixed: Event Manager did not trigger a File Transfer Event when uploading a file to a virtual directory with a trailing slash
• Other minor bug fixes and improvements

• New: Log files can now be filtered by IP or username
• New: In Server Manager, changing admin passwords is now separate from editing admin accounts
• Fixed: In Event Manager, the HTTP Post event action stopped including variables
• Fixed: In Event Manager, the error “An address incompatible with the requested protocol was used” occurred when connecting to an SMTP server
• Fixed: Cerberus service would not start on Windows Server 2008
• Fixed: When responding to an FTP STOR command, Cerberus sent a 426 reply instead of a 500 reply when the parent folder does not exist
• Fixed: In User Manager, CSV import of users allowed users in groups that did not exist
• Fixed: Images and videos cannot be previewed in the HTTP/S web client
• Other minor bug fixes and improvements

• Cerberus customers that block outgoing connections with their firewall should only have to allow connections to the domain www.cerberusftpserver.com with IP address 216.92.201.26 for Cerberus to auto-update
• New: Cerberus now performs certificate and host name verification for all outgoing SSL/TLS connections by default
• New: Event Manager now has a Transfer File Target that allows transferring files to another server via SFTP, FTP, FTPS, HTTP PUT, and HTTPS PUT
• New: Event Manager now has labels for Event Targets so that administrators can assign unique names to differentiate between them
• Removed unnecessary newlines from the log
• Fixed: When Cerberus checks for updates, those outgoing SSL/TLS connections did not verify the certificate or host name
• Fixed: In User Manager, requiring a user to change their password does not actually force the user to change their password after logging in
• Fixed: Log Manager displays a “parseerror” message when the log contains binary data
• Fixed: In Event Manager, modifying a cloned event applies changes to the original event
• Fixed: In Server Manager, changes to SSH Security Defaults are automatically saved without confirmation
• Other minor bug fixes and improvements

• User Manager guided workflows for creating users and groups, including enhanced data validation and error checking
• Upgraded admin password change controls for setting and changing user and administrator passwords
• Easily adjust generated password lengths beyond the minimum at the time of password generation
• Multiple enhancements to the Log Manager including a continuous log view with no paging, a configurable refresh rate, visual indications to indicate when the log will next refresh, as well as a dedicated context menu item and toolbar button to immediately refresh the log
• Added support for additional SSH2 key exchange methods to include diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512
• Upgraded to gSOAP 2.8.99 to address gSOAP security vulnerabilities
• FTP commands for setting file date/time provide better error messages on failure
• Fixed: Filter/Find for HTTP/S web client allows bypassing of virtual directory permissions
• Fixed: In User Manager, new users and groups no longer need an initial save before you can add new virtual directories
• Fixed: In User Manager, the disable date constraint for users and groups ignores PM times
• Other minor bug fixes and improvements

• Fixed: Memory leak when querying which groups a user is a member of in Active Directory

• Fixed: Memory leak when statistics file cannot be opened at startup
• Fixed: Cerberus crashes when there are multiple HTTP/S web client requests for a new localization language file
• Fixed: Log Manager displays a “parseerror” message when the log contains binary data
• Fixed: SCP does not handle using single quotes around filenames
• Allow administrators to view queue sizes for diagnostic purposes
• Other minor bug fixes and improvements

• Fixed: Memory leaks when transferring files via SFTP
• Fixed: Cerberus crashes when HTTP/S web client receives a malformed URL
• In Active Directory administration, searching for users and groups when creating mappings will now use the Binding Options credentials instead of the credentials for the account running the Cerberus FTP Server Windows service
• Other minor bug fixes and improvements

• Fixed: In Log Manager, scripts errors occur when using the right-click menu options
• Fixed: In User Manager, updating a user shows an error message when using group overrides
• Other minor bug fixes and improvements

• Upgraded to OpenSSL 1.0.2u to address OpenSSL security vulnerabilities
• Cerberus now shows a warning that legacy managers are deprecated and will be removed in a future version
• Other minor bug fixes and improvements

• Fixed: Unzip for HTTP/S web client allows bypassing of blocked file extensions
• Fixed: Folder Monitor status is never updated
• Other minor bug fixes and improvements

• Fixed: XSS Vulnerability When Previewing SVG Content
• Fixed: In User Manager, removing a native Cerberus user from a group shows an error message
• Fixed: Public shares are shown even though they have expired
• Fixed: Public shares allow creating shares that are already expired
• Log Manager displays much faster now
• In Active Directory administration, searching for users and groups when creating mappings should be faster
• Other minor bug fixes and improvements

• Fixed: Zip and unzip for HTTP/S web client allow bypass of virtual directory permissions
• We now show a warning during installation that Cerberus 11 is not officially supported on Windows Server 2008 and 2008 R2
• Other minor bug fixes and improvements

• Fixed: In Event Manager, Scheduled Tasks drift later after each run
• Fixed: In Event Manager, Scheduled Tasks do not run as scheduled for weekdays
• Fixed: Long message notifications are not formatted correctly
• Fixed: Cerberus displays an error message for missing MF.dll on Windows Server 2008 R2
• Fixed: Cerberus install fails even though Internet Explorer 9+ has been installed
• Other minor bug fixes and improvements

• Fixed: Cerberus does not lock out a user’s account after numerous failed 2FA attempts allowing brute force attacks
• Fixed: HTTP/S web client public shares are vulnerable to a XSS attack that can execute arbitrary JavaScript
• Other minor bug fixes and improvements

• Significantly faster performance (up to 10x) when writing files across the network using the Server Message Block (SMB) protocol
• Enhancements to User Manager UI (Desktop GUI and web administration) for a responsive and consistent experience across devices
• In web administration, User Manager now allows managing blocked file extensions and CSV export/import of users
• User Manager provides richer visual feedback when previewing the import of users from a CSV file
• User Manager shows all of the members of a group including Cerberus Native users, LDAP users, AD users, and AD groups
• Web administration now shows connections, transfers, and logging
• Log Manager logs IP addresses and usernames when logging connection-related events
• Log Manager allows administrators to download log files
• Log Manager provides features such as searching, row grouping, column sorting, and showing/hiding columns
• New notification system displays small pop-up notifications about events that are important to the user
• New notification system allow administrators to view a history of changes made during their session
• Redesigned Server Manager for better segmentation and grouping of server configuration options
• In Server Manager, administrators can require uppercase and lowercase letters in their password complexity policy
• Cerberus supports nested group membership for the AD “Require Security Group Membership” option
• HTTP/S web client localization can now be accessed and modified directly from the Desktop GUI
• Fixed: Password reset is vulnerable to HTTP host header attack allowing malicious password reset emails