--- title: PingFederate 11.3.1 (August 2023) description: Improved PF-33667 component: pingfederate version: 13.1 page_id: pingfederate:release_notes:pf_release_notes_1131 canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_1131.html llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: July 22, 2024 section_ids: new-features-and-enhancements: New features and enhancements configuration-retrieval-on-engine-start-up: Configuration retrieval on engine start up resolved-issues: Resolved issues jetty-library-upgrade: Jetty library upgrade oauth-scope-names: OAuth scope names policy-fragment-validation-error: Policy fragment validation error eliminating-redundant-group-updates: Eliminating redundant group updates potential-security-vulnerability: Potential security vulnerability pingfederate-as-a-windows-service: PingFederate as a Windows service authentication-policy-fail-path: Authentication policy fail path fragment-mapping-validation-error: Fragment mapping validation error authorization-details-within-a-rar: Authorization details within a RAR cluster-engine-nodes-starting-without-replication-data: Cluster engine nodes starting without replication data server-error-when-revoking-user-sessions: Server error when revoking user sessions potential-security-vulnerability-2: Potential security vulnerability fragment-mapping-validation-errors: Fragment mapping validation errors updated-template-variable: Updated template variable potential-security-vulnerability-3: Potential security vulnerability policy-evaluation-issue: Policy evaluation issue certificate-import-improvements: Certificate import improvements dynamodb-attribute-lookup-error: DynamoDB attribute lookup error --- # PingFederate 11.3.1 (August 2023) ## New features and enhancements ### Configuration retrieval on engine start up Improved PF-33667 We introduced new settings in the `cluster-config-replication.conf` file to improve configuration retrieval reliability during engine startup. By setting *publish.replication.data.on.startup* to `true`, the administrative console automatically publishes the last replicated configuration upon startup, eliminating the need to initiate replication through the administrative UI or API after a console restart. Additionally, you can configure engines to fail startup if they cannot retrieve configuration data by setting *require.replication.data.on.startup* to `true`. This setting proves beneficial in DevOps deployments, where fresh engine nodes are frequently created without any initial configuration. For more information, see the *publish.replication.data.on.startup* and *require.replication.data.on.startup* property descriptions in [Cluster management](../administrators_reference_guide/pf_cluster_management.html). ## Resolved issues ### Jetty library upgrade Fixed PF-31865 We upgraded the Jetty library, resolving CVE-2022-2047 and CVE-2022-2048. ### OAuth scope names Fixed PF-33056 Using `submit` and `onSubmit` as OAuth scope names in the administrative UI drop-down no longer causes front-end JavaScript errors. ### Policy fragment validation error Fixed PF-33156 Policy fragments with valid authentication sources no longer fail with an Invalid Configuration error during runtime. ### Eliminating redundant group updates Fixed PF-33441 PingFederate, when configured with PingDirectory as an outbound provisioning data source, no longer sends redundant group updates in each provisioning cycle when the entry remains unchanged. ### Potential security vulnerability Fixed PF-33449 We've resolved a potential security vulnerability that is described in security advisory [SECADV037](https://support.pingidentity.com/s/article/SECADV037-PingFederate-Security-Rollup-Denial-of-Service-Information-Disclosure-Authentication-Bypass-Vulnerabilities). ### PingFederate as a Windows service Fixed PF-33450 We fixed an issue so that PingFederate as a Windows service now runs on Java 17. When updating to the latest maintenance release using an in-place update method (for example, from 11.3.0 to 11.3.x), in addition to the steps in [Updating to the latest maintenance release](../upgrading_pingfederate/pf_updating_latest_maintenance_release.html), you must remove the existing PingFederate Windows service. After removal, re-install the PingFederate Windows Service to apply this fix. ### Authentication policy fail path Fixed PF-33519 When an OIDC identity provider (IdP) connection fails in an authentication policy, PingFederate now continues on to the fail path of the authentication policy. ### Fragment mapping validation error Fixed PF-33722 We resolved an issue that incorrectly produced an administrative API validation error when the fragment mapping references `context.RequestedUser` as the mapping source. ### Authorization details within a RAR Fixed PF-33863 PingFederate now processes authorization details within a rich authorization request (RAR) as a JSON Array in a JWT request. Additionally, PingFederate no longer supports authorization details sent as stringified JSON arrays. ### Cluster engine nodes starting without replication data Fixed PF-33881 Resolved a replication issue that, in rare cases, caused an engine node in a cluster to start without replication data from other nodes. ### Server error when revoking user sessions Fixed PF-33920 Resolved an issue that prevented user sessions from being revoked through the session management API when using persistent sessions. ### Potential security vulnerability Fixed PF-33935 We've resolved a potential security vulnerability that is described in security advisory [SECADV037](https://support.pingidentity.com/s/article/SECADV037-PingFederate-Security-Rollup-Denial-of-Service-Information-Disclosure-Authentication-Bypass-Vulnerabilities). ### Fragment mapping validation errors Fixed PF-33957 When utilizing the PingFederate administrative API to create or update a fragment that includes another fragment, the API will no longer produce a validation error when fragment mapping involves an input source type. ### Updated template variable Fixed PF-34016 The `message-template-end-user-password-change.html` template now contains the *USERNAME* variable. ### Potential security vulnerability Fixed PF-34017 We've resolved a potential security vulnerability that is described in security advisory [SECADV037](https://support.pingidentity.com/s/article/SECADV037-PingFederate-Security-Rollup-Denial-of-Service-Information-Disclosure-Authentication-Bypass-Vulnerabilities). ### Policy evaluation issue Fixed PF-34051 We fixed a policy evaluation issue that occurred when `ui_locales` was present in an authentication request. ### Certificate import improvements Fixed PF-34074 We updated the administrative UI to include certification serial number in the drop-down, thus preventing import errors for certifications sharing the same Subject DN and expiration date combination. ### DynamoDB attribute lookup error Fixed PF-34099 We fixed an attribute lookup error that occurred when different DynamoDB attributes shared an overlapping path.