---
title: PingFederate 11.3.5 (February 2024)
description: Security PF-34720
component: pingfederate
version: 13.1
page_id: pingfederate:release_notes:pf_release_notes_1135
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_1135.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: July 22, 2024
section_ids:
  resolved-issues: Resolved issues
  rest-datastore-security-vulnerability: Rest datastore security vulnerability
  runtime-nodes-security-vulnerability: Runtime nodes security vulnerability
  openid-connect-policy-management-editor-security-vulnerability: OpenID Connect policy management editor security vulnerability
  get-saml-request-signature-processing-error: GET SAML request signature processing error
  npe-notification-error: NPE notification error
  reencyption-causes-connection-or-client-to-fail-on-engine: Reencyption causes connection or client to fail on engine
  jmx-registration-failure-for-imported-archives: JMX registration failure for imported archives
  content-type-changes-if-well_known-endpoint-response-is-too-large: Content type changes if well_known endpoint response is too large
  rhel-8-using-os-level-fips-causes-pingfederate-failure: RHEL 8 using OS-level FIPS causes PingFederate failure
  unable-to-deobfuscate-grant-attributes: Unable to deobfuscate grant attributes
  valid-authorization-policy-generates-configuration-error-message: "Valid Authorization policy generates \"Configuration Error\" message"
---

# PingFederate 11.3.5 (February 2024)

## Resolved issues

### Rest datastore security vulnerability

Security PF-34720

Fixed a JSON injection vulnerability in REST datastores described in security advisory [SECADV044](https://support.pingidentity.com/s/article/SECADV044-PingFederate-Security-Rollup).

### Runtime nodes security vulnerability

Security PF-34896

Fixed a path traversal vulnerability in Runtime nodes described in security advisory [SECADV044](https://support.pingidentity.com/s/article/SECADV044-PingFederate-Security-Rollup).

### OpenID Connect policy management editor security vulnerability

Security PF-35081

Fixed a Cross-Site Scripting vulnerability in the OpenID Connect Policy Management Editor described in security advisory [SECADV044](https://support.pingidentity.com/s/article/SECADV044-PingFederate-Security-Rollup).

### GET SAML request signature processing error

Fixed PF-34641

Fixed a defect where SAML request using HTTP GET method with multiple signature-related parameters encoded in the *RelayState* parameter were causing errors in processing signature validation.

### NPE notification error

Fixed PF-34813

Fixed a defect that caused PingFederate to issue null pointer exception (NPE) errors when querying the token endpoint.

### Reencyption causes connection or client to fail on engine

Fixed PF-34409

Fixed a defect where changes made on the administrative console were not replicated to the engine during reencryption.

### JMX registration failure for imported archives

Fixed PF-34796

Fixed a defect that caused the JMX monitoring to fail to register archive files that are imported to PingFederate.

### Content type changes if `well_known` endpoint response is too large

Fixed PF-34865

Fixed a defect that caused the `content-type` of a response from the `well_known` endpoint to change from JSON to HTML if a response is too large.

### RHEL 8 using OS-level FIPS causes PingFederate failure

Fixed PF-34879

Fixed a defect that caused PingFederate to fail on startup when installed on a Red Hat Enterprise Linux (RHEL) server with OS-levels FIPS enabled.

### Unable to deobfuscate grant attributes

Fixed PF-34839

Fixed a defect where PingFederate was unable to deobfuscate grant attributes of a certain length.

### Valid Authorization policy generates "Configuration Error" message

Fixed PF-34853

Fixed a defect that caused PingFederate to incorrectly return an "Invalid Configuration" error for a valid authentication policy.