Security

Hi! I am getting a warning that FMEFlow is affected by CVE-2024-56337. I am running FME Flow 2023.1.1Is this correct?Is there a fix or are these CVE not applicable? Best regards/Kim 

 We're sending CORS headers, but not getting them back. How do we get them back?

Using FME Server 2021.1 Build 21607 - win64,  we have applied the Security Update: FME Flow Privilege Escalation Vulnerability using this link https://support.safe.com/hc/en-us/articles/31265482270349-Security-Update-FME-Flow-Privilege-Escalation-Vulnerability but even after applying the patch and re-starting FME services and even rebooting the hosting VM we are still seeing this message!  I know it is possible to just click on X and close this notification on admin page but I noticed that other team members who didn't close the notification still seeing that on page!Should we ask everyone to ignore it!

Hey guys,Why do I get the error (some texts replaced for security reasons):Failed to load http://fme-serverdomain.com/fmedatadownload/repository/workspace.fmw?param1=somefile&param2=sometext&opt_responseformat=json&token=123456789&detail=high: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://someotherdomain.com' is therefore not allowed access.although I configured CORS to allow all hosts

Hi, I am trying to send EMAIL on Port 587 from FME Flow application (V 2023.1.1) and I get below error. Can someone please help on how to resolve this error? Do I need to specify port 587 on any configuration file? 

HiWe are about to configure Azure AD (Entra ID) Integration to authenticate users to our FME Flow. There are some workspace applications (flow apps) that are embedded into an ArcGIS Portal Experience builder app. The authentication to the ArcGIS Portal is also done with Azure AD accounts. The idea is, that the end user will open the ArcGIS Portal web application and access the FME Flow workspace application from that platform, rather than re-navigate to the Flow app. If SSO is enabled, will the FME Workspace/Flow app application authenticate automatically without extra login to the workspace application, when it is accessed from the ArcGIS Portal Experience application, as it is embedded to the application? Current setup with basic user authentication and FME Flow user access control fully inside FME Flow naturally requires a log-in to the app OR requires the Flow app to be published without authentication, but we want to ensure security. Does anyo

HiI am the admin in my organisation for FME Flow and I woke this mornig with this messagehttps://support.safe.com/hc/en-us/articles/31265482270349-Security-Update-FME-Flow-Privilege-Escalation-VulnerabilityThe problem is that I can’t access it even after it asked me to log in.​@safe can you point me out to the right issue so I can understand the vulnerability that it might implicate in out environment?Best regards,Felipe Verdú

Today we saw this broadcast message from Safe Software on our FME Flow servers (2023.2.2):The link in the message is not working and I do not see any recent security issues. We have only external ports configured for dynamic engines and licenses. The FME Flow instance is not accesible from outside out network.I find a strange that they can create broadcast messages on our servers.That is all a bit suspicious, is anyone else experiencing the same? 

Hi Folks,I have previously installed and worked on FME Server, with my last usage being approximately 2–3 months ago.However, I am currently unable to log in, and the system displays the following error message:Could someone please assist in identifying the cause of this issue and guide me on resolving it?Thank you in advance for your support.

Out-of-the-box, FME Flow has an admin login for administration (member of fmeadmin and fmesuperuser).As a measure of added security, can a different, less common, login name be used for administration? In other words, if I were to create a login for administration purpose named MickeyMouse, add MickeyMouse to fmeadmin and fmesuperuser roles, and disable admin, does that work? Are there gotcha’s with doing that? Is it a measure of added security?

We currently have a process where an automation is stopped by any upstream failure triggering a workspace which contains a httpcaller with a call to the fme rest api to stop the automation. The request is configured to use $(FME_SERVER_WEB_URL) and an the Automation General Attribute/Key AutomationID to construct the request for the api so in this way it is generic. I’m wondering if there’s any way to use the user running the automation as authentication for the http request?

Hi, looking for help please. We are using FME Flow 2024.1.3 Build 24627 - linux-x64 on Ubuntu 24.04 and trying to connect to an external FTP server to transfer files from FME Flow. Our client who owns the FTP Server are asking us to authenticate with both username / password and public / private keys ; we’ve supplied our client with the public key which they’ve loaded successfully. We can connect ok manually using both username / password and public / private keys, but when we try from FME Flow it fails on the public / private key and forces us to enter the password.What we are looking for is a way to call using the public / private key and also specifying a password. 

I have created an FME Server App. Is it possible to provide permission for another user to edit the App?I have granted full permission to Create Apps and also to the specific App to my other user but I get this error message when the user tries to edit the App:This Server App is owned by "admin". Only the owner or a user who can manage FME Server security permissions can edit this App.This seems to be highly restrictive.

FME Flow 2023.2.1Build 23774 I’m planning on upgrading FME Form / Flow this weekend which includes fixing the following vulnerabilities detected from our internal Pen Test. USR-640 Email Servers Advertise Software Type and Version Removing the software banner from the email server is typically done in the configuration file, for example sendmail.cf or postfix.conf.Is it possible to fix this and where would the file(s) be located?What change should take place? USR-622 HSTS Missing from HTTPS ServerIs it simply enough to add the following to the web.xml config file? <!-- Enable HSTS --><filter> <filter-name>httpHeaderSecurity</filter-name> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class> <init-param>

Dear reader,  I want to know if it is possible (if yes, how) to connect FME with an Azure File Storage with OAuth. The Azure connection transformer, AzureFileStorageConnector seem to not have a Oauth connection possible. Is this true and are there other ways to make an Oauth connection to Azure File Storage in FME Desktop? 

On fme server, web connections we can authorise the named connections as various accounts. How can we check what accounts these are currently authorised as?  Thanks

Is it possible to run workspaces in FME Server as different user accounts i.e. service accounts? I am aware of running FME Services Engine as a different account. The issue there is that over time you will have to grant this account access to a lot of different resources and this would not be good cyber-security practice.

Hi everyone, This question is about the detailed permissions user/role management interface.We’ve been facing issues finding all permissions required to run a specific workspace, like allowing services, access to shared ressources data and to specific connexions.  The question is: Is there a hint to grant or list all these needed permissions to run a specific workspace ?  Thank’s in advance. Kevin

Running 2023.2 (both Flow and Form) and I have SAML setup, configured, and working on Flow.  However, in Form, when I add a FME Flow Connection - the SAML drop down under Authentication is missing even though the documentation says it should be there.What am I missing?? Missing SAML option in Authentication drop down FME Flow:Our FME Flow site with SAML enabled Documentati

Hi all, New user here - trying to get a support-only role set up for a few on my team in FME Form. We sometimes have jobs that need to be resubmitted and would like the support role to have the ability to do this but to NOT be able to edit the workspaces or automations at all. I have played around with editing the role permissions and no matter what I try, the users are not able to resubmit jobs. They can get to the job and view logs but get an ‘Unauthorized request by user due to lack of permissions...’ error. Has anyone experienced something like this or have any idea on what permission set would be tied to resubmitting jobs?Thank you!

ArcGIS Server can be configured to disallow administrative tasks from being conducted via REST. Is there something similar with an FME Flow that has a proxy server to do something similar--disallowing administrative logons via the proxy server (direct logon to FME Core machine only)?

Is TLS 1.3 supported for FME 2023.2.1?How do you go about finding this out? ThanksKeith

We currently have FME-supplied Flexnet running on a Windows server and would like to use the same daemon to licence another product. I have checked in the manual and the suggestion is that I simply need to tweak the other product licence file to point at a different port. However as the current Flexnet install does not show FME as he vendor file, when I try adding a vendor file it causes and error as it can’t find the FME licence file. I did put the other product’s licence file in the same folder as the FME file. I have also spotted a post that suggested adding the second products licence to the same file with FME pointing at the default port (27000) and the other product point at a second port.Can you advise what is the best approach?ThanksChris

Hello,FME Desktop 2022.2.5, using OpenSSL 3.0.8.0, is being flagged by Defender as having three weaknesses: CVE-2023-0464, CVE-2023-0465 and CVE-2023-0466. I can't find anything here about these three: Is there anything known about them? CVE-2023-0465 and CVE-2023-0466 are being re-analyzed, so I appreciate that we need to wait for the outcome of that analysis, but CVE-2023-0464 could potentially be quite harmful.  Thanks,Stefan

In case you missed it you can now access web connection and database connection details in python now.Using the SystemCaller and PythonCallers in the past have always enabled remote code execution but since FME 2023 now your connections are also exposed. Just a reminder to never run what you don’t trust.