ArcGIS GeoEvent Server Security Update 2021 Patch

This security patch addresses a security vulnerability found in ArcGIS GeoEvent Server and also includes several non-security related fixes. Esri recommends that all customers using ArcGIS GeoEvent Server 10.6.1, 10.7.1, and 10.8.1 apply this patch.

Esri® announces the ArcGIS GeoEvent Server Security Update 2021 Patch. Esri recommends that all customers using ArcGIS GeoEvent Server 10.6.1, 10.7.1, and 10.8.1 apply this patch. This patch specifically addresses the issues listed in Enhancements and Issues Addressed with this patch.

Note: Each version of this security patch is cumulative of only those fixes previously released for the version it addresses. This means that each patch includes several security and non-security related fixes from earlier patches which are also listed below under Enhancements and Issues Addressed with this Patch. It is highly recommended that users of ArcGIS GeoEvent Server 10.6, 10.7, and 10.8 upgrade to the latest release of the version to get a full set of available fixes for the version.

• Clearing the browser cache will be required after this patch is installed to properly load the updated GeoEvent Manager User Interface.
• ArcGIS GeoEvent Server 10.8.1 must be installed before you can install this patch.
• ArcGIS GeoEvent Server Patches cannot be uninstalled. To roll back a patch requires a fresh install of GeoEvent Server.

Enhancements and Issues Addressed with this Patch

• ArcGIS GeoEvent Server Directory Traversal security update
• BUG-000139249 - ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.

To avoid conflicts at 10.8.1 these issues are also addressed:

• BUG-000131593 - A hosted feature service's identifier should be preserved when changes to the service's properties are published.
• BUG-000131860 - Value for inbound adapter's SpatialReferenceField property is not populated when importing an XML snapshot of a GeoEvent Server configuration.
• BUG-000131803 - Expected date format is ignored when inbound event data has a string of digits.
• BUG-000133699 - Initial startup and restart issues between the GeoEvent Gateway and GeoEvent Server prevent the Manager application from loading correctly.
• BUG-000138583 - GeoEvent Manager panels are not listing hosted services alphabetically as they are listed in the REST Services Directory.
• BUG-000138585 - Feature service publication fails in a non-federated environment when creating a new BDS Data Source.
• BUG-000100984 - The GeoEvent Text Adapter fails to parse certain Latin characters.
• BUG-000131776 - Send an Email output does not handle complete set of UTF-8 characters.
• BUG-000132926 - Sampler and Event Viewer(map) popup cannot show the multibyte language strings correctly.
• BUG-000132928 - GeoTagger Processor does not allow writing to existing fields when using Enter or Exit operations.
• BUG-000132930 - GeoEvent Sampler label strings are incorrectly displayed for supported non-English languages.
• BUG-000132931 - Sampler displays prettified JSON data universally as String when attributes are numeric.

To avoid conflicts at 10.7.1 these issues are also addressed:

• BUG-000131860 - Value for inbound adapter's SpatialReferenceField property is not populated when importing an XML snapshot of a GeoEvent Server configuration.
• BUG-000131803 - Expected date format is ignored when inbound event data has a string of digits.
• BUG-000129649 - Unable to completely stop or delete Kafka based input connectors.
• BUG-000125490 - The Update A Feature Output fails to update feature events after the feature class records have been deleted from the REST Endpoint.
• BUG-000128797 - GeoTagger Processor misses eligible event records and creates false-positive tags on invalid event records.
• BUG-000128798 - Spatial filters using inside/outside operators fail to detect geofence geometry changes from feature service layer based synchronization.
• ENH-000125502 - Fix geoevent gateway crash on stream service name case sensitivity.

To avoid conflicts at 10.6.1 these issues are also addressed:

• BUG-000131860 - Value for inbound adapter's SpatialReferenceField property is not populated when importing an XML snapshot of a GeoEvent Server configuration.
• BUG-000120348 - Stream Services encountering dropped events and instability when processing high complexity or high velocity data streams.
• BUG-000118323 - Event throughput degradation.
• BUG-000119717 - GeoEvent Service validation fails to catch loops in the service event processing pipeline.
• BUG-000116360 - Connectivity to the spatiotemporal big data store is lost when connection info can't be fetched/created from a data store connection after a sync.
• BUG-000113018 - Requests to update feature records fail after features are deleted when feature service is published by ArcGIS Pro.
• BUG-000117250 - Stream Service GeoFence Sync Rule does not start IF the layer is not ready in the DataStore Cache.
• BUG-000117249 - System instability observed when using stream services to synchronize geofences.
• BUG-000117248 - GeoEvent won't stop promptly when there is a sync rule configured using stream service.
• BUG-000114501 - Address a deserialization flaw in the jackson-databind libraries.

Installation Instructions for Windows

Note: ArcGIS GeoEvent Server must be installed before installing this patch.

1. Login with an Administrator Windows account.
   
   
2. Download the appropriate file to a location other than your ArcGIS GeoEvent installation location.
   
   

   ArcGIS 10.8.1
   GeoEvent Server	GeoEvent_10_8_1_Patch2.msp
   Checksum      (SHA256)	AD61ECBF4F5F77AC2372E115ABE895B03EFE07D8EE415334E798601254607258
   ArcGIS 10.7.1
   GeoEvent Server	GeoEvent_10_7_1_Patch2.msp
   Checksum      (SHA256)	51EA6A2FAEF5BCB8087297A27CC63CC5D7CEC0369D542420EBEA1DB0DC126165
   ArcGIS 10.6.1
   GeoEvent Server	GeoEvent_10_6_1_Patch2.msp
   Checksum      (SHA256)	3A07AAFB16D0EE3C0E01F922AE6D8EC74293341AB965A9BAB4FB699078088480

   
   
3. Double-click the MSP file to start the setup process.
   
   Note: If double clicking on the MSP file does not start the setup installation, you can start the setup installation manually by using the following command:
   
   msiexec.exe /p [location of Patch]\GeoEvent__Patch2.msp
   
4.  After the setup is complete, restart the ArcGIS GeoEvent Windows Services.
5. Open the GeoEvent Manager to ensure your inputs, outputs, and GeoEvent Services have been started. If they are not, restart them in the GeoEvent Manager.

 

Installing this patch on Linux

1. Log in as the user that installed ArcGIS Server.
   Note: For the Amazon AMI this is the user arcgis.
2. Download the appropriate file to a location other than your ArcGIS installation location.
   
   

   ArcGIS 10.8.1
   GeoEvent Server	GeoEvent-10.8.1-Patch2.tar.gz
   Checksum  (SHA256)	4CB4E5F11AA216A72B1E06B5428F391773A0DB31FFC49653DC964B9DC557674A
   ArcGIS 10.7.1
   GeoEvent Server	GeoEvent-10.7.1-Patch2.tar.gz
   Checksum  (SHA256)	36686F412FE21CE41E33A8A9D51C81F69D26EF103EB6963505C55D179EB211A4
   ArcGIS 10.6.1
   GeoEvent Server	GeoEvent-10.6.1-Patch2.tar.gz
   Checksum  (SHA256)	8C772CC66D61B07C655B96D007082FF0E3D72248E18FD40DB1231EF33E4607D6

3. Extract the package:
   % tar -xzvf GeoEvent--Patch.tar.gz
    
4.  Stop the GeoEvent daemon services.
5. Start the installation:
   % ./GeoEvent/Patch.sh
    
6. Delete the contents of the GeoEvent Server data folder.
   % rm -rf /GeoEvent/data/*
    
7. After the setup is complete, restart the GeoEvent daemon services.
8. Open the GeoEvent Manager to ensure your inputs, outputs, and GeoEvent Services have been started. If they are not, restart them in the GeoEvent Manager.

Patch Updates

How to identify which ArcGIS products are installed

Getting Help

Download ID:7895