---
title: PingFederate 11.3.3 (November 2023)
description: Security PF-34645
component: pingfederate
version: 13.1
page_id: pingfederate:release_notes:pf_release_notes_1133
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_1133.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: August 1, 2024
section_ids:
  resolved-issues: Resolved issues
  improved-client-authentication-security: Improved client authentication security
  added-support-for-partitioned-cookies: Added support for partitioned cookies
  fixed-idpstartslo-ping-404-caused-by-virtual-issuer-configuration: Fixed /idp/startSLO.ping 404 caused by virtual issuer configuration
  client-jwks-now-sets-properly-when-using-dynamodb-storage: Client JWKS now sets properly when using DynamoDB storage
  fixed-npe-when-checking-an-existing-persistent-grant-that-is-expired-with-dynamodb: Fixed NPE when checking an existing persistent grant that is expired with DynamoDB
  connections-close-after-getting-a-401-or-403-from-pingone-api: Connections close after getting a 401 or 403 from PingOne API
  outbound-provisioning-performance-improvement: Outbound provisioning performance improvement
  unable-to-copy-and-paste-policy-contract-in-specific-situations: Unable to copy and paste policy contract in specific situations
  xml-decryption-failing-with-keyname-element: XML decryption failing with KeyName element
  resolved-a-vulnerability-in-the-initial-setup-wizard: Resolved a vulnerability in the Initial Setup Wizard
  certificate-in-use-detection-slowdown: Certificate in-use detection slowdown
  upgraded-third-party-libraries: Upgraded third-party libraries
---

# PingFederate 11.3.3 (November 2023)

## Resolved issues

### Improved client authentication security

Security PF-34645

Fixed a potential security vulnerability described in security advisory [SECADV040](https://support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass).

### Added support for partitioned cookies

New PF-34440

PingFederate now supports using the `Partitioned` attribute to address third-party cookie issues with the iframe-based login widgets in Google Chrome.

### Fixed `/idp/startSLO.ping` `404` caused by virtual issuer configuration

Fixed PF-34322

Fixed an issue that was returning a `404` error if the `/idp/startSLO.ping` endpoint was hit while a virtual issuer was configured. You can now configure virtual issuers with a context path.

### Client JWKS now sets properly when using DynamoDB storage

Fixed PF-34504

Clients that maintain a JWKS endpoint can now use private key JWT based authentication when requesting an access token.

### Fixed NPE when checking an existing persistent grant that is expired with DynamoDB

Fixed PF-34606

Checking for existing but expired grants with DynamoDB no longer causes a null pointer exception error (NPE).

### Connections close after getting a `401` or `403` from PingOne API

Fixed PF-34545

Fixed an issue preventing PingFederate from closing connections after receiving a `401` or `403` response from PingOne MFA.

### Outbound provisioning performance improvement

Fixed PF-33466

You can now turn off server-side sorting for LDAP requests related to outbound provisioning, which can improve performance in some environments.

Configure this option using the `ProvisionWithServerSort` parameter in the `com.pingidentity.common.util.ldap.LDAPUtil.xml` file.

### Unable to copy and paste policy contract in specific situations

Fixed PF-34433

You can now copy and paste a policy contract below a selector node.

### XML decryption failing with `KeyName` element

Fixed PF-34536

Fixed an issue where decryption of an encrypted SAML element could fail if a `KeyName` was specified.

### Resolved a vulnerability in the Initial Setup Wizard

Security PF-34646

Fixed a Server-Side Request Forgery vulnerability in the Initial Setup Wizard described in security advisory [SECADV041](https://support.pingidentity.com/s/article/SECADV041-PingFederate-Server-Side-Request-Forgery).

### Certificate in-use detection slowdown

Fixed PF-34077

We fixed a defect that caused PingFederate to check every certificate when loading certificate-related pages in the administrative interface, which slowed down performance.

### Upgraded third-party libraries

Improved

* Upgraded Jetty to version 9.4.53.v20231009.

* Upgraded JGroups to version 4.2.24.Final.