Portal for ArcGIS 10.7.1 High Availability Licensing Patch

This patch addresses an issue preventing license information from being updated after a failover event in a high availability configuration.

Update October 8, 2020: The 10.7.1 version of the Portal for ArcGIS Security 2020 Update 1 Patch is obsolete. Please download and install Portal for ArcGIS 10.7.1 High Availability and Disaster Recovery Quality Patch. It addresses several issues, as well as the following two issues below that directly affect this patch

Esri® announces the Portal for ArcGIS Security 2020 Update 1 Patch. Esri recommends that all customers using Portal for ArcGIS 10.5 through 10.7.1 apply this patch. This patch deals specifically with the issues listed below under Issues Addressed with this patch.

Note: Each version of this security patch is only cumulative of fixes previously released for the version it addresses. This means that each patch includes several security and non-security related fixes from earlier patches that are also listed below under Issues Addressed with this Patch such that the 10.5 version is cumulative of previous 10.5 patches, the 10.5.1 version is cumulative of previous 10.5.1 patches, and so on. It is highly recommended that users of Portal for ArcGIS 10.5, 10.6, and 10.7 upgrade to the latest minor release in order to get a full set of available fixes for that release series. The full list of issues addressed with these patches is available in the Issues Addressed with this patch section.

October 7, 2020: Applying Portal for ArcGIS 10.7.1 Security 2020 Update 1 Patch causes a known bug, BUG-000132359, in which proxy requests to an external URL cannot be made for outgoing requests. BUG-000132359 is fixed for version 10.8.1 of Portal for ArcGIS, and will be fixed in the upcoming Portal for ArcGIS 10.7.1 Security 2020 Update 2 Patch.

 

Issues Addressed with this patch

 

• BUG-000128058 - Portal for ArcGIS has a Server Side Request Forgery (SSRF) security vulnerability.
    CVSS 3.0 Base Score: 9.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

To avoid conflicts the 10.7.1 version also addresses:

• BUG-000129821 - After installing the Portal for ArcGIS 10.7.1 High Availability Licensing Patch, the Portal Home Application, or components of it such as the App Switcher, may hang or fail to load after simultaneous requests are made for Integrated Windows Authentication (IWA) users.
• BUG-000128486 - After sharing a map from ArcGIS Pro with two layers as referenced and editable, users are unable to open the Smart Editor widget from the pop-up because the Options button is disabled.
• BUG-000128438 - Unable to save the query widget results from Web AppBuilder for ArcGIS when Portal for ArcGIS is configured with Public Key Infrastructure (PKI) or Integrated Windows Authentication (IWA).
• BUG-000128038 - Delay in Portal for ArcGIS permitting access to secured content within a group for new Enterprise members who login using Integrated Windows Authentication (IWA).
• BUG-000127934 - Attributes are not shown completely in pop-up window when an image service with a raster function template to symbolize the data is published to ArcGIS Server, and added to Portal Scene Viewer.
• BUG-000126709 - When an image service with raster function template to symbolize data is published to ArcGIS Server and added to Portal Map Viewer, attributes are not shown completely in pop-up window.
• BUG-000126332 - Token is removed from cookie when Integrated Windows Authenticated users click the Scene tab in a Portal that has disabled anonymous access.
• BUG-000126259 - Feature server layers do not consistently appear in the drop-down list of possible layers to perform analysis in Portal for ArcGIS.
• BUG-000126166 - Failover in a highly available portal will result in "Failed to get current license information. This connection has been closed" errors in the logs.
• BUG-000126009 - When using the Attribute Table widget in the Web AppBuilder for ArcGIS to select many attributes in the table, only 150 attributes are selectable.
• BUG-000125961 - In Portal for ArcGIS 10.6.1, if a layer has related records and a copy is created, the related records do not appear in pop-ups for the copied layer.
• BUG-000125434 - A geoprocessing service with the GPDataFile input type does not provide the option to upload a file in the Web AppBuilder for ArcGIS geoprocessing widget in Portal for ArcGIS 10.7.1.
• BUG-000125332 - Unable to set the role of ArcGIS Server to federated server with restricted publishing in ArcGIS Enterprise deployment.
• BUG-000125033 - Users signed in through Integrated Windows Authentication (IWA) cannot search for layers under My Organization in Map Viewer.
• BUG-000124953 - Portal for ArcGIS application information exposure
• BUG-000124739 - The Smart Editor option is unavailable in the Web AppBuilder for ArcGIS pop-up, if the layer is shared from ArcGIS Pro as a reference and is editable in the web map.
• BUG-000124011 - Web AppBuilder for ArcGIS in Portal for ArcGIS does not display results when clicking ‘Show more results’ in the Search widget.
• BUG-000123690 - Reflected cross-site scripting (XSS) in the Portal for ArcGIS home application
    CVSS 3.0 Base Score: 5.4 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• BUG-000123331 - The Attribute Table widget does not show related records consistently.
• BUG-000119150 - When a field contains a Range Domain, values do not appear in the Attribute Table widget in Web App Builder
• BUG-000116557 - The selected features do not honor the Attribute Table widget filter in Portal for ArcGIS 10.6.1 Web AppBuilder.
• BUG-000116343 - In Web AppBuilder for ArcGIS, the Group Filter widget pane is cut off when the German-Deutsch language is set in the ArcGIS Online account.
• BUG-000116089 - The Web AppBuilder for ArcGIS Query widget filter expression is configured to only show 'Values filtered by previous expressions' lists all unique values instead of a filtered set when the previous expression is configured from the Group Filter widget.
• ENH-000123305 - Include relationship name along with table name to better distinguish different relationships on the same table.

To avoid conflicts the 10.7 version also addresses:

• BUG-000121734 - Unable to embed images in a Story Map Cascade app.
• BUG-000121359 - Support sharing Insights items, using Distributed Collaboration, which have been upgraded from earlier software versions.
• BUG-000121139 - Unable to complete the 'Forgot Password' workflow.
• BUG-000121102 - Unable to publish hosted feature services because of indexing service failures when the Portal for ArcGIS deployment locale is Arabic.
• BUG-000115859 - When selecting line or polygon features for layers with pop-ups enabled, the selection symbology does not match the actual feature geometry.

To avoid conflicts the 10.6.1 version also addresses:

• BUG-000127276 - When accessing a secured service from a federated Server through Map Viewer or Web AppBuilder in Portal for ArcGIS 10.6.1 using IWA, the service token fails to regenerate automatically and causes the service to become blank when the token expires.
• BUG-000124953 - Portal for ArcGIS application information exposure
• BUG-000124382 - After allowing Google Chrome to save your account details, the 'Add Item' > 'From the web' option displays the error 'The service type is not valid'.
• BUG-000123690 - Reflected cross-site scripting (XSS) in the Portal for ArcGIS home application.
    CVSS 3.0 Base Score: 5.4 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• BUG-000123331 - The Attribute Table widget does not show related records consistently.
• BUG-000123043 - Decrease the number of JavaScript files loaded when printing in the Portal map viewer.
• BUG-000121732 - The custom basemap does not appear in the Web AppBuilder for ArcGIS Basemap widget although the group is set as the default in the Edit settings under Organization.
• BUG-000121145 - Portal proxy does not fully validate allowedProxyHosts parameter
    CVSS 3.0 Base Score: 4.0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
  
• BUG-000120392 - Smart Editor Widget Fails to Set Attribute Action Expressions in Portal for ArcGIS 10.6.1
• BUG-000120333 - Reflected cross-site scripting (XSS) in the Portal for ArcGIS home application
    CVSS 3.0 Base Score: 8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  
• BUG-000120061 - Related data points to the same feature in Web AppBuilder for ArcGIS for Portal for ArcGIS when there are multiple relationships to the same feature class.
• BUG-000119891 - Portal for ArcGIS profiles allow HTML injection (Only in 10.6.1 and 10.5.1)
    CVSS 3.0 Base Score: 3.5 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• BUG-000117926 - Unable to synchronize collaboration workspaces when the guest participant's content directory uses a Cloud Store.
• BUG-000117564 - Privilege escalation vulnerability
• BUG-000117369 - Reflected cross-site scripting (XSS) in item URL
• BUG-000117367 - Un-validated redirect in Portal for ArcGIS
• BUG-000116870 - Unable to share Insights Workbooks, Pages and Model items to Everyone.
• BUG-000116734 - The Attribute Table widget selections are not consistently honored by the Edit widget.
• BUG-000116687 - Temporal filters created from tool parameters in Portal for ArcGIS Map Viewer are incorrectly formatted and cause tool failures.
• BUG-000116195 - Panning and zooming in the web maps on a touch screen device does not work in Google Chrome 68.x.
• BUG-000115964 - The App Launcher becomes unavailable after the external content is disabled.
• BUG-000115859 - Starting at zoom level 18, the selection shape of a selected polygon differs from the shape of the polygon for map services added at the map server level from an ArcGIS Server 10.6.1
• BUG-000114004 - The Show Related Records option in the Attribute Table widget returns no records in the related table.
• BUG-000112707 - Reflected cross-site scripting (XSS) in Portal for ArcGIS Home application.
• BUG-000112342 - The webgisdr incremental restore fails when Geo Analytics Server is federated and registered with Portal as the Geo Analytics Server.
• ENH-000123305 - Include relationship name along with table name to better distinguish different relationships on the same table.
• ENH-000116621 - Add the ability to modify the maximum token expiration time of tokens generated to login to Portal for ArcGIS when using IDP-initiated logins.

To avoid conflicts the 10.6 version also addressses:

• BUG-000123523 - The Attribute Table widget in ArcGIS Online does not display the ongoing process of loading features when the 'Filter by map extent' option is deselected.
• BUG-000121222 - The Attribute widget in Web AppBuilder for ArcGIS does not return consistent records when exporting attribute to CSV for a feature layer with large records (millions) in Portal for ArcGIS.
• BUG-000121145 - Portal proxy does not fully validate allowedProxyHosts parameter.
• BUG-000117564 - Privilege escalation vulnerability.
• BUG-000114738 - Internet Explorer 11 does not properly encode spaces in certain Portal request URLs, which causes the request to fail in Portal Linux 10.6
• BUG-000109526 - The 'Filter' widget in WebApp Builder for ArcGIS does not honor the layer's date format setting.
• ENH-000116621 - Add the ability to modify the maximum token expiration time of tokens generated to login to Portal for ArcGIS when using IDP-initiated logins.

To avoid conflicts the 10.5.1 version also addresses:

• BUG-000124953 - Portal for ArcGIS application information exposure
• BUG-000124317 - Improper server side validation of uploaded file types
• BUG-000122276 - Portal item details show 'Shared with: item is not share' when item is shared to a group when logged in using a custom role.
• BUG-000121145 - Portal proxy does not fully validate allowedProxyHosts parameter
    CVSS 3.0 Base Score: 4.0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
  
• BUG-000120333 - Reflected cross-site scripting (XSS) in the Portal for ArcGIS home application
    CVSS 3.0 Base Score: 8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  
• BUG-000119891 - Portal for ArcGIS profiles allow HTML injection (Only in 10.6.1and 10.5.1)
    CVSS 3.0 Base Score: 3.5 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• BUG-000117564 - Privilege escalation vulnerability
• BUG-000117369 - Reflected cross-site scripting (XSS) in item URL
• BUG-000117367 - Un-validated redirect in Portal for ArcGIS
• BUG-000116992 - When configuring the Create Buffer analysis tool in the Portal for ArcGIS map viewer, changing the input buffer layer between different geometry types does not correctly refresh the available buffer options.
• BUG-000116195 - Panning and zooming in the web maps on a touch screen device does not work in Google Chrome 68.x.
• BUG-000114549 - The contrast between active and inactive arrows of the extent navigator in Web AppBuilder for ArcGIS must be increased when against dark backgrounds.
• BUG-000114533 - If the Portal restore or upgrade fails, it should roll back to its previous state automatically.
• BUG-000114489 - Keyhole Markup Language (KML) servlet does not fully honor the proxy settings.
• BUG-000114488 - Portal for ArcGIS index service has a security vulnerability.
• BUG-000113157 - Portal for ArcGIS Import Site fails if the backup contains Thumbs.db files.
• BUG-000112749 - Reflected cross-site scripting (XSS) in ArcGIS Online Map Viewer.
• BUG-000112707 - Reflected cross-site scripting (XSS) in Portal for ArcGIS Home application.
• BUG-000112595 - Clicking the email link in the Share widget causes an unwanted browser navigation prompt.
• BUG-000112477 - The Add marker Feature Action does not work as expected.
• BUG-000112360 - Portal for ArcGIS Web Application Builder has a cross-site scripting (XSS) vulnerability.
• BUG-000112358 - Sanitize URLs provided to legend resource to remove invalid characters in SOAP URL.
• BUG-000112357 - Unvalidated redirect in /portal/sharing/login and portal/sharing/rest/login endpoints of Portal for ArcGIS.
• BUG-000112161 - Portal for ArcGIS CityEngine Web Viewer has a reflected cross-site scripting (XSS) issue.
• BUG-000112088 - The Show Table operation in the Portal for ArcGIS 10.5.1 web map does not return the attribute of the image service.
• BUG-000112059 - In Portal for ArcGIS, the Select options of the Buffer tool in the Analysis widget of Web AppBuilder for ArcGIS remains stuck if the hosted feature layers is in the following order: points, polygons, polylines, and back to points.
• BUG-000112026 - After applying the Portal for ArcGIS Security 2018 Update 1 Patch, when signing into Portal for ArcGIS Home application, if a domain user types an incorrect password, all domain users then become locked out of Portal for ArcGIS.
• BUG-000111942 - Symbology is not retained on a shared feature layer when a filter is applied and the layer is accessed by another user to create their own web map.
• BUG-000111424 - Pop-ups display when switching between the Draw, Measurement, and Coordinate widgets.
• BUG-000111090 - Select widget loses selection when using Create Layer functionality on a layer added via the Add Data widget in Web AppBuilder in Portal for ArcGIS.
• BUG-000111077 - Execution Error: Illegal Value Assignment to Feature When Editing Labels in a Portal Web Map with Layer Visibility turned off.
• BUG-000111058 - Arcade Editor makes calls to "fast.fonts.net" domain, causing significant delays in disconnected networks.
• BUG-000110677 - Previously drawn data is not cleared off the screen when zooming out.
• BUG-000110632 - GeoEvent based map and feature services that are related should not become combined together when both are added to the Map Viewer table of contents.
• BUG-000110542 - In Web AppBuilder for ArcGIS, the Create Layer option is not enabled if only one feature is selected.
• BUG-000110291 - Portal for ArcGIS should not parse entity tags.
• BUG-000110290 - Remove invalid record entries from the Portal for ArcGIS internal database.
• BUG-000109870 - In the map viewer, vector tiles do not respect visible scale settings when zooming out and polygons are distributed in non-adjacent areas.
• BUG-000109517 - In the 10.5.1 Portal for ArcGIS Map Viewer, the Create Labels panel does not function for map services published from map document with 'Allow assignment of unique numeric IDs for map service publishing' setting specified.
• BUG-000108753 - Portal for ArcGIS configured with portal-tier authentication and automatic account creation enabled will create accounts that exceed the number of licenses available.
• BUG-000108364 - The Add Data widget included in Portal for ArcGIS and the Web App Builder Developer edition returns an error after browsing to a CSV file.
• BUG-000108155 - Endless generateToken requests are triggered in map viewer when token expires for a Portal configured with Integrated Windows Authentication (IWA) and federated with ArcGIS Server.
• BUG-000107814 - Create Labels does not work in Portal for ArcGIS 10.5.1 for ArcGIS Server 10.5.1 Map Services.
• BUG-000107440 - Portal for ArcGIS disallows access to portaladmin when the actual machine name is not listed in the certificate.
• BUG-000107004 - An error message is returned when running the Extract Data Task geoprocessing service in the Web AppBuilder for ArcGIS for Portal for ArcGIS 10.5.1 in Internet Explorer.
• BUG-000106917 - Portal for ArcGIS 10.5.1 Map Viewer does not load the Bing Roads Base Map when HTTPS only is enabled due to certificate mismatch errors on the requested tiles.
• BUG-000106909 - Filtering a map service does not filter the attribute table in the web map.
• BUG-000106874 - Attachments are not preserved in the popup in web maps when using search by layer functionality.
• BUG-000106303 - Portal for ArcGIS does not fully honor the 'domainControllerAddress' setting in the security configuration.
• BUG-000105202 - When accessing a secured service in Portal with saved credentials, the proxied generate token request does not honor the nonProxyHosts parameter.
• BUG-000105062 - The Add Data widget included in Portal for ArcGIS and the Web App Builder Developer edition fails to draw results after browsing to a zipped shapefile.
• BUG-000104949 - Basemaps in the WGS84 coordinate system do not draw in the Item Details Set Extent dialog box.
• BUG-000103846 - Portal for ArcGIS has a hard-coded credential vulnerability.
• ENH-000103213 - Add an option to enforce encrypted communication between Portal for ArcGIS and Active Directory.

To avoid conflicts the 10.5 version also addresses:

• BUG-000117564 - Privilege escalation vulnerability
• BUG-000112314 - Unable to print web maps in the map viewer when the default basemap is a Web Map Tile Service (WMTS) that is not in Web Mercator Auxiliary Sphere coordinate system.
• BUG-000111550 - Cross-site scripting (XSS) issue in Portal for ArcGIS.
• BUG-000108753 - Portal for ArcGIS configured with portal-tier authentication and automatic account creation enabled will create accounts that exceed the number of licenses available.
• BUG-000104521 - Portal for ArcGIS performance is impacted as the number of members increases.
• BUG-000103165 - Unable to share with users in Portal Active Directory (AD) nested group configurations across domains.
• BUG-000102793 - Large Active Directory group structures cause latency issues with Portal for ArcGIS.
• BUG-000099854 - A proxy call within Portal for ArcGIS does not support Server Name Indication (SNI).

 

Installing this patch on Windows

 

Installation Steps:

 

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

1. Download the appropriate file to a location other than your ArcGIS installation location.
   
   

   ArcGIS 10.7.1		Checksum (Md5)
   Portal for ArcGIS	Please download and install Portal for ArcGIS 10.7.1 High Availability and Disaster Recovery Quality Patch
   ArcGIS 10.7		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-107-PFA-SEC2020U1-Patch.msp	7238AC72FAFFA732A6F5480A714AC701
   ArcGIS 10.6.1		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-1061-PFA-SEC2020U1-Patch.msp	77BD03B67A530623D92957C7909766B5
   ArcGIS 10.6		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-106-PFA-SEC2020U1-Patch.msp	EC035FE6BD4BBBDAF2A252314DA99B23
   ArcGIS 10.5.1		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-1051-PFA-SEC2020U1-Patch.msp	2393CBA038EDF9DBC508F0D48241EBEF
   ArcGIS 10.5		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-105-PFA-SEC2020U1-Patch.msp	47C2DFBD1E72B60A75DE6FAFFBC0BCB1

   
   
2. Make sure you have write access to your ArcGIS installation location.
3.  Double-click ArcGIS-<Version>-PFA-SEC2020U1-Patch.msp to start the setup process.
   NOTE: If double clicking on the MSP file does not start the setup installation, you can start the setup installation manually by using the following command:
   
   msiexec.exe /p [location of Patch]\ArcGIS-<Version>-PFA-SEC2020U1-Patch.msp

 

Installing this patch on Linux

 

Installation Steps:

 

Complete the following install steps as the ArcGIS Install owner. The Install owner is the owner of the arcgis folder.

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

1. Download the appropriate file to a location other than your ArcGIS installation location.
   
   
   

   ArcGIS 10.7.1		Checksum (Md5)
   Portal for ArcGIS	Please download and install Portal for ArcGIS 10.7.1 High Availability and Disaster Recovery Quality Patch
   ArcGIS 10.7		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-107-PFA-SEC2020U1-Patch-linux.tar	D2737031AA5CDE2EFEA881553ED99AAA
   ArcGIS 10.6.1		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-1061-PFA-SEC2020U1-Patch-linux.tar	F40EB75BD32319EF5676722A32F33D0E
   ArcGIS 10.6		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-106-PFA-SEC2020U1-Patch-linux.tar	20FDAF228BE9AC30FE34C563574C690C
   ArcGIS 10.5.1		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-1051-PFA-SEC2020U1-Patch-linux.tar	C4C0AA787065C63012DAE31C72A528BF
   ArcGIS 10.5		Checksum (Md5)
   Portal for ArcGIS	ArcGIS-105-PFA-SEC2020U1-Patch-linux.tar	AE2D12B457C5A31CA3EB5A7BA139008D

   
   
2. Make sure you have write access to your ArcGIS installation location, and that no one is using ArcGIS. 
3. Extract the specified tar file by typing:
   
   % tar -xvf ArcGIS-<Version>-PFA-SEC2020U1-Patch-linux.tar

   
4. Start the installation by typing:
   
   % ./applypatch
   
   This will start the dialog for the menu-driven installation procedure. Default selections are noted in parentheses ( ). To quit the installation procedure, type 'q' at any time.

Uninstalling this patch on Linux

 

 

 

Patch Updates

How to identify which ArcGIS products are installed

Getting Help

Download ID:7771