CVE-2022-47507: SolarWinds Platform 2023.1 Release Notes

Release date: February 15, 2023

These release notes describe the new features, improvements, and fixed issues in SolarWinds Platform 2023.1. They also provide information about upgrades and describe workarounds for known issues.

Learn more

• For information on latest hotfixes, see SolarWinds Platform Hotfixes.
• For release notes for previous SolarWinds Platform versions, see Previous Version documentation.
• For information about requirements, see SolarWinds Platform 2023.1 System Requirements.
• For information about working with the SolarWinds Platform, see the SolarWinds Platform Administrator Guide.

New features and improvements in SolarWinds Platform

Return to top

SolarWinds Platform 2023.1 offers the following improvements compared to previous releases of SolarWinds Platform.

AlertStack

AlertStack is a new feature that can help reduce alert noise and assist in possible root cause analysis to give you a quicker MTTR (mean time to resolution). AlertStack is an opt-in feature that must be turned on in AlertStack settings. AlertStack continually monitors alerts and change events and correlates these using SolarWinds Platform topological information, pulling associated events and alerts together into a single alert cluster. The alert cluster stays activated, and correlated alerts will continue to be added to the cluster, for as long as any associated alerts remain active.

AlertStack is disabled by default and can be enabled after upgrading by navigating to All Settings > Product Specific Settings > AlertStack Settings.

Other improvements

• SolarWinds Platform agent installer packages and Linux/AIX repositories are signed.

• SWIS REST Endpoint is now available on port 17774. You can use a custom HTTPS certificate for this port and disable SWIS REST endpoint on 17778. See Disable port 17778 for SWIS Endpoint.

  In 2023.1, you can continue using port 17778. However, please note that it is being deprecated and will not be supported in a future version.

• SolarWinds Platform 2023.1 improves the Kerberos protocol for WMI authentication by adding support for the SAM module. See Configure Kerberos for WMI authentication in the SolarWinds Platform.

New customer installation

Return to top

For information about installing SolarWinds Platform, see SolarWinds Installer.

How to upgrade

Use the SolarWinds Installer to upgrade your entire SolarWinds Platform deployment (all SolarWinds Platform products and any scalability engines) to the current versions.

You must be on Orion Platform 2020.2.1 or later to upgrade to SolarWinds Platform 2023.1. If you are on Orion Platform 2020.2 or earlier, first upgrade to 2020.2.6 and then upgrade to 2023.1.

Before you upgrade from 2020.2.x

• Before upgrading from Orion Platform 2020.2.6 and earlier to SolarWinds Platform 2022.3 or later, make sure the database user you use to connect to your SQL Server has the db create privilege. Without this privilege, the upgrade will not complete.

• The legacy syslog and traps functionality has been retired and replaced with new functionality called SolarWinds Log Viewer, which can be upgraded to Log Analyzer for additional capabilities. Current rules and history will automatically be migrated to the new logging functionality (SolarWinds Log Viewer or Log Analyzer). The functionality of SolarWinds Log Viewer and Log Analyzer has been improved to more closely match legacy functionality. See LA 2022.3 release notes for details.

  If you built syslog and trap alerts using custom SQL queries, they will not function after upgrading to 2022.3 or later. SolarWinds recommends you rewrite the alerts using SWQL (Orion.OLM entities) or using the alerting functionality built into Log Viewer/Log Analyzer.

• Some upgrade situations from the Orion Platform to the SolarWinds Platform are not supported and the installer will stop the upgrade automatically.

  • If you have a SQL Server older than 2016.
  • If you have an Orion Platform product version 2020.2 or earlier.

Fixed issues

Return to top

SolarWinds Platform 2023.1 fixes the following issues.

Case Number

Description

938365, 987784, 1049100, 1084320, 1120320, 1183057

The issue where the Database Maintenance failed to execute ‘Finalize Maintenance’ was addressed. Fixed in the GA version.

1268655, 1268939, 1270366, 1273013, 1275253

The SQL Script issue preventing the Configuration Wizard from completing was addressed. Fixed in the GA version.

1253873, 1254055, 1254256, 1254257, 1254265, 1254276, 1254278, 1254303, 1254316, 1254326, 1254333, 1254339, 1254372, 1254403, 1254405, 1254414, 1254435, 1254499, 1254502, 1254523

Auto-geolocation issues in the Worldwide Map were addressed. Fixed in the GA version.

1229888, 1235682

The issue where HTML reports layout was broken when using the MailBee SMTP client was addressed.

1208950, 1226555, 1234992

The issue where upgrading Scalability Engines failed when the SolarWinds Administration service on the main polling engine had been updated was addressed.

1230025

The issue where pre-staging of upgrade files failed was addressed.

1204779, 1206691, 1233017, 1243901

The issue where the Configuration wizard failed to connect to RabbitMQ because of a timeout was addressed.

1241585

Offline help instructions were updated.

1211020, 1214429

The issue where new SolarWinds Platform agent installations were not using FQDN was addressed.

1197599, 1248066

The issue where a new SolarWinds Platform databasecould not be installed on Azure SQL due to incorrectly detected SQL version was addressed.

1212089

The issue where a table widget did not update vendor icon properly was addressed.

1105407, 1192112, 1201507, 1213144

The issue where the Custom Properties for Nodes widget didn’t show data was addressed.

1197642

The issue where shared actions are not re-created during alert import when the original shared action doesn’t exist were addressed.

1201173

The issue where the Configuration Wizard enabled Windows Authentication even if the user did not select the option was addressed.

1198432

The issue where the Maintenance Expiration pre-installation check did not work for old bundle licenses was addressed.

1195664

The issue where a group added on a SolarWinds Platform Map was not shown an All Groups was addressed.

1162734

The issue where a 2020.2.* installer could not be used on an environment where a 2022.* installer was run was addressed.

1237949

The HTTP 500 Internal Server Error caused by blank StyleSheet setting was addressed.

636868

The issue where the Database Maintenance failed was addressed.

1132904

The issue where SolarWinds Platform agent installed in the root folder ended non-SolarWinds Platform agent processes was addressed.

1190747

The issue where canceling an upgrade stuck on Active Diagnostics tests was addressed.

1185124

The issue where PDF reports generated by alert or report actions were blurred by a Pendo popup was addressed.

444472, 479695

The issue where topology polling timeout was not retained after the upgrade was addressed.

1218043

The issue when running a simple task in the Unmanage Utility was addressed.

561899, 1120328

The issue where special characters in the preview blocked creating a report was addressed.

732106, 1120328

The issue where reports failed due to a ‘hexadecimal value 0x01 is an invalid character’ message was addressed.

809693

The issue where the SNMPv3 credentials set was updated unexpectedly on the Edit Node view was addressed.

1151608, 1193149, 1202770, 1205056, 1216386, 1231980, 1235579, 1242067, 1252490

The issue where groups based on node custom properties are unsorted in widgets was addressed.

1162222

The issue where a LogAdjuster record for SAML and Account Management was missing was addressed.

615600, 947219, 947737, 989480

The issue where unmanaged status was incorrectly used for group availability was addressed.

46302, 213954, 255637, 691325, 777333

The issue where List Resources cannot proceed a big number of resources thus preventing the user to add a node was addressed.

1094013

The issue with filters in the Worldwide Map widget was addressed.

915697

The issue where Linux agent deployment methods were not working with FIPS was addressed.

938027

The issue where the Discovery job keeps WMI attempts when WMI credentials are deleted was addressed.

CVEs

SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.

CVE-ID

Vulnerability Title

Description

Severity

Credit

CVE-2022-38111

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

The SolarWinds Platform was susceptible to the Deserialization of Untrusted Data vulnerability. This vulnerability allows a remote adversary with SolarWinds admin-level account access to messaging service to execute arbitrary commands.

7.2 Medium

Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative

CVE-2022-47504

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

The SolarWinds Platform was susceptible to the Deserialization of Untrusted Data vulnerability. This vulnerability allows a remote adversary with SolarWinds admin-level account access to messaging service to execute arbitrary commands.

8.8 High

Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative

CVE-2022-47503

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

The SolarWinds Platform was susceptible to the Deserialization of Untrusted Data vulnerability. This vulnerability allows a remote adversary with SolarWinds admin-level account access to messaging service to execute arbitrary commands.

8.8 High

Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative

CVE-2022-47506

SolarWinds Platform Directory Traversal Vulnerability

The SolarWinds Platform was susceptible to the Directory Traversal vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.

8.8 High

Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative

CVE-2022-47507

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

The SolarWinds Platform was susceptible to the Deserialization of Untrusted Data vulnerability. This vulnerability allows a remote adversary with SolarWinds admin-level account access to messaging service to execute arbitrary commands.

8.8 High

Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative

CVE-2023-23836

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

The SolarWinds Platform was susceptible to the Deserialization of Untrusted Data vulnerability. This vulnerability allows a remote adversary with SolarWinds admin-level account access to messaging service to execute arbitrary commands.

8.8 High

Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative

Known issues

Return to top

N/A

2023.1 RC displayed as the GA version in Centralized Upgrades

Issue: When you upgrade SolarWinds Platform from 2023.1 RC1 to the GA version, the UI displays upgrade from 2023.1 to 2023.1.

Workaround: Not available. Functionality is not impacted.

1202271, 1246753

Remanaging nodes triggers the Node Reboot alert

Issue: When you unmanage a remanage node, the Node Reboot alert gets triggered.

Workaround: Before unmanaging nodes, disable the Node Reboot alert. See Mute alerts.

1203621, 1225932, 1234310, 1234575, 1239208, 1241208, 1251663

Database maintenance errors related to CMAN_Containers

Issue: When you run Database Maintenance, errors including CMAN_Container errors are available in the logs.

Workaround: Not available. Functionality is not impacted.

1052957, 1240424, 1245960, 1256606, 1257671, 1266763, 1276328, 1267382, 1280926

SolarWinds Information Service performance issues when users without admin rights use PerfStack

Issue: If users without administrator rights open PerfStack views after the upgrade to 2023.1, SolarWinds Information Service (SWIS) performance issues might occur. SWIS log includes error messages and the SolarWinds Platform Web Console displays warnings about long-running queries.

Workaround: Restart the SWIS service.

End of life

Return to top

For modules based on Orion Platform 2020.2.6 and earlier, SolarWinds is announcing future end-of-life plans for your convenience. As always, SolarWinds recommends you upgrade to the latest version of your products at your earliest convenience.

Version

EOL Announcements

EOE Effective Dates

EOL Effective Dates

2020.2.6

April 18, 2023: End-of-Life (EoL) announcement – Customers on Orion Platform 2020.2.6 should begin transitioning to the latest version of SolarWinds Platform.

May 18, 2023: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for Orion Platform 2020.2.6 will no longer be actively supported by SolarWinds.

May 18, 2024: End-of-Life (EoL) – SolarWinds will no longer provide technical support for Orion Platform 2020.2.6

2020.2.5

January 18, 2023: End-of-Life (EoL) announcement – Customers on Orion Platform 2020.2.5 should begin transitioning to the latest version of SolarWinds Platform.

February 17, 2023: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for Orion Platform 2020.2.5 will no longer be actively supported by SolarWinds.

February 17, 2024: End-of-Life (EoL) – SolarWinds will no longer provide technical support for Orion Platform 2020.2.5.

2020.2.4

October 19, 2022: End-of-Life (EoL) announcement – Customers on Orion Platform 2020.2.4 should begin transitioning to the latest version of SolarWinds Platform.

November 18, 2022: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for Orion Platform 2020.2.4 will no longer be actively supported by SolarWinds.

November 18, 2023: End-of-Life (EoL) – SolarWinds will no longer provide technical support for Orion Platform 2020.2.4.

2020.2.1

October 19, 2022: End-of-Life (EoL) announcement – Customers on Orion Platform 2020.2.1 should begin transitioning to the latest version of SolarWinds Platform.

November 18, 2022: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for Orion Platform 2020.2.1 will no longer be actively supported by SolarWinds.

November 18, 2023: End-of-Life (EoL) – SolarWinds will no longer provide technical support for Orion Platform 2020.2.1.

2020.2

October 19, 2022: End-of-Life (EoL) announcement – Customers on Orion Platform 2020.2 should begin transitioning to the latest version of SolarWinds Platform.

November 18, 2022: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for Orion Platform 2020.2 will no longer be actively supported by SolarWinds.

November 18, 2023: End-of-Life (EoL) – SolarWinds will no longer provide technical support for Orion Platform 2020.2.

See the End of Life Policy for information about SolarWinds product lifecycle phases. For supported versions and EoL announcements for all SolarWinds products, see Currently supported software versions.

Deprecation notices

Return to top

Deprecated platforms and features are still supported in the current release. However, they will be unsupported in a future release. Plan on upgrading deprecated platforms, and avoid using deprecated features. Customizations applied to a deprecated feature might not be migrated if a new feature replaces the deprecated one.

For information about supported versions of SolarWinds products, see Currently supported software versions.

Type

Details

Network Atlas

Network Atlas is deprecated as of Orion Platform 2020.2 and will be removed in a future release. SolarWinds recommends that you start using SolarWinds Platform Maps in the SolarWinds Platform Web Console to display maps of physical and logical relationships between entities monitored by the SolarWinds Platform products you have installed.

Port 17778

SWIS REST Endpoint on port 17778 is deprecated as of 2023.1 and will be replaced with port 17774 in a future release. SolarWinds recommends that you start migrating SWIS REST Endpoint to port 17774.

Internet Explorer 11

Internet Explorer 11 is deprecated as of SolarWinds Platform 2023.1 and will be removed in a future release. See SolarWinds Platform Web Console browser requirements for a list of supported browsers.

Legal notices

Return to top

© 2023 SolarWinds Worldwide, LLC. All rights reserved.

This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software, services, and documentation are and shall remain the exclusive property of SolarWinds, its affiliates, and/or its respective licensors.

SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION NONINFRINGEMENT, ACCURACY, COMPLETENESS, OR USEFULNESS OF ANY INFORMATION CONTAINED HEREIN. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY, EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies.