Security

Hi there, I am trying to use FME to automate some user management for FME Server. Specifically I would like to schedule a workspace to remove any Azure users that are not members of a role. I have worked out how to list the users and get their roles, but I can't work out how to go from this json array: ["user:admin","fmeadmin","fmesuperuser"] to the integer value 2. Can anyone please help me drop the "user:..." part from the array and count the number of items that are left over? Thanks!Marc

Hi, I am trying to expose an attribute from the _response_body returned from a http caller. This is the response: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2022-11-24T11:20:34.572Z</u:Created><u:Expires>2022-11-

Hello everyone,In regards to the security issues in regards to Apache Text Commons 1.6 till 1.9, I was wondering whether FME dekstop makes use of this file and if yes, one needs to be worried about it?

I have set up integration between FME Server (v2021.2.6) and Azure AD where I am able to import users from AAD and native AAD users are able to single sign in using microsoft. The problem is that Guest users in AAD are not able to single sign in using Microsoft login. It seems that the FME server logon instead tries to authenticate through the users home-tenant. Does anyone have experience with this setup?

Windows 2019/ FME Server 2022.0.2. We weary of doing full FME Server upgrades when all we really need to do is upgrade Tomcat for security vulnerabilities. TC is currently embedded in Server, can we install latest TC externally (on the server but not part of fme) and hook to that?

Hi! Have anybody succeeded in connecting the Mapillary API v4 with FME workbench? I get stuck on an internal server error when i use https://localhost/ as redirect URL in the OAuth 2.0 webservice authentification.

We are on the process to upgrade FME 2015 to 2020. Because all of the security regulations our cybersecuirty team blocking this from happening without getting an answers for the following question, we do appreciate if you can help us with this.What types of applications are being coded and in what languages?What training has been provided or completed in secure application development by the development team?What is the Software Development LifeCycle, and how does security form a part of this?Do the applications take inputs or variables? If yes, how are they sanitised?Are whitelists being used in place of blacklisted characters?Are automated tools used to scan for vulnerabilities, what is the time frame for high and critical vulnerabilities to be remediated?Where will the code repository sit?How are error exceptions handled?What network separ

Hello,Is there any info if FME server is affected by new vulnerability CVE-2022-42889 (Apache Commons Text versions 1.5 through 1.9)?

When creating a connect to AD, what is the synchronnization period?

I've been digging into issues with an Engine running on a separate host in a distributed setup. Service looks to be running but is no longer chatting with Core and is not longer showing up under Engines in the web UI. After ruling out some of the obvious causes on this troubleshooting page. I've started logging running processes and ports being used on that Host to understand at what point the service goes silent or inactive. That's when I noticed what seems like large number of TCP connections FMEProcessMonitorEngines uses with multiple ports open. The

https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities In this latest advisory it's mentioned that there are two specific XSS issues, and two different CVE assignments. That's all well and good, even if there is a ton of lacking pertinent information.  The problem I'm having is that this CVE (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38339) was assigned to this specific advisory but there's zero mention of it. Does anyone know specifically why 2022-38339 was assigned?

Quick question about the Windows account that FME Server uses. If I write an FME script that reads from, say, a CSV file and writes to an Oracle table, the Oracle account that gets used is specified in the connection parameters. But what Windows account

Using FME(R) 2021.2.5.0 (20220331 - Build 21816 - WIN64)  desktop on windows PRO build 2009.1766 65g RAM, 6 cores, experiences massive CPU drain when running a LIDAR density analysis out to raster via the custom transformer as in article - Calculating Point Cloud Density (safe.com)The two step tiler seems to trigger a Windows security scan when using the FME_TEMP directory as FME writes the (many) temporary cache ffs files down to disk when demanding a 1m high res raster result. The security kicks in and the CPU starts skipping up to 80%+ which drags the performance way down on large LIDAR file sets. Setting the raster res lower (10m) doesn't seem to trigger the same issue The FME_TEMP directory cannot be included in the security white list (corporate policy settings only - as each works

I have created an encoded password user parameter and used it with the job submitter, but if the job submitter returns an error, the password is decrypted and shown in the log, as seen in the screenshots below.  

Hi,I have a FME workbench, so i have to use it within my organization and i want to restrict it to outsiders based on domain name or in any possible way. how can i do this ?

Dear community,Upcoming June the 14th Microsoft DCOM will get ‘hardened’ by a update. Therefore I would like to know if the DCOM-protocol is used in any way within FME and if anyone knows this update could affect FME server. If this is the case, it is necessary to test the new hardening. For more information on this update: (https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c) Used FME server versions: FME server 2018.1 & 2021.1

Hello Our security scan has detected a vulnerability against the version of Apache Tomcat installed.The Web server installed on the remote host is prior to 9.0.48. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.48_security-9 advisory. Tomcat Release-Notes: 9.0.44FME Server Build: FME Server 2021.1.1 / Build 21619 - win64 ThanksSameer

A serious security alert (CVE-2022-21724) was announced for the PostgreSQL JDBC driver on February 2, 2022. We need to upgrade PostgresSQL JDBC driver to 42.2.25 and above to remediate it.  We have identified total 4 PostgresSQL JDBC drivers in FME Server and FME Desktop:[FME Server Root]\\Utilities\\tomcat\\lib\\postgresql-42.2.24.jar[FME Server Root]\\Utilities\\jdbc\\postgresql-42.2.24.jar[FME Server Root]\\Server\\fme\\plugins\\postgresql-42.2.16.jar[FME Desktop Root]\\FME\\plugins\\postgresql-42.2.16.jar Is there any patch available to remediate this vulnerability in those products? Or can we just replace those drivers with the required version?

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {228826AF-02E1-4226-A9E0-99A855E455A6} and APPID {2FD08A73-D1F1-43EB-B888-24C2496F95FD} to the user <user> SID (S-1-5-21-73586283-1409082233-725345543-564895) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Is FME Server affected by the recent vulnerability discovered in Spring Core? https://www.contrastsecurity.com/security-influencers/new-spring4shell-vulnerability-confirmed-what-it-is-and-how-to-be-prepared

I have a working Postman script for an OAuth2 connection.When I look at the raw headers it shows that it sends the following headers:Content-Type: application/x-www-form-urlencodedAuthorization: Basic QjIzRkI3RUU5RTZDRZZZQTRCRDJGNjVEOUM5ZZZxNjE6QzAzM0ZDOTU0RjM5NDQ1Qjg2RjdCOUQ1QzlGQzQ2MDYwM0Q1QkUwNEIzMEE3ZZZDMzFCMTI5NzM5M0MxQUMwRQ==User-Agent: PostmanRuntime/7.29.0Accept: */*Cache-Control: no-cachePostman-Token: a8126467-b10d-4a59-b116-f8a6d1160aa8Host: projectlocation.relaticsonline.comAccept-Encoding: gzip, deflate, brConnection: keep-aliveContent-Length: 182Cookie: SESSION_START_COOKIENAME_29C5C999-84D0-4D23-A8F0-F888A8C64C78=trueBut if I add a new Webservice with the OAuth2 template in FME it looks like it is sending:https://projectlocation.relaticsonline.com/oau

We have a use case where we need to implement a webhook using FME. This will be called by a partner application.This webhook has a predefined URI (in partner application side) like:https://fmeserver/repo/worskapce1.fmw?attr=?attr2=?Names of parameters cannot be changed and partner application is not willing to update the webhook to pass security token in the header. We are planning to do security by only whitelisting the ip addresses of the partner application. In this case, how we do call the FME workspace? Everytime I try to call my workspace, it returns an following error"401-Unauthorized. The request has not been applied because it lacks valid authentication credentials for the Target resource" Is there no way to call FME workspaces without passing tokens in the

Currently we are usen FME Desktop 2020.1. In the webconnection we have made connections to our ESRI platform (Arcgis Enterprise). SO when using a workbench data can be extracted from our arcgis enterprise portal. Is it possible to secure the data stored in a web connection in FME Desktop. We would like to prevent anyone who has gained acces to one of our account to also use the web connections to reach the account data stored in the web connection.

Hello all, Our IT department has the policy to remove all the vulnarible Log4j related files from the systems which came from a server scan.  We have a FME server 2020.1 with engine 2020.2.5The scan gives the following files: C:\\Program Files\\FMEServer\\Server\\fme\\plugins\\activemq-all-5.6.0.jarC:\\Program Files\\FMEServer\\Server\\fme\\plugins\\log4j-1.2.16.jarC:\\Program Files\\FMEServer\\Server\\FMEEngineUpgrade\\plugins\\activemq-all-5.6.0.jarC:\\Program Files\\FMEServer\\Server\\FMEEngineUpgrade\\plugins\\log4j-1.2.16.jarC:\\Program Files\\FMEServer\\Server\\lib\\log4j-1.2.14.jarC:\\Program Files\\FMEServer\\Utilities\\tomcat\\webapps\\fmeapiv4.warC:\\Program Files\\FMEServer\\Utilities\\tomcat\\webapps\\fmeapiv4\\WEB-INF\\lib\\logback-classic-1.2.3.jarC:\\Program Files\\FMEServer\\Utilities\\tomcat\\webapps\\fmerest.war&quot

Hi,We have installed a FME Server 2020.1.1.1 with a 2020.2.5.1 engine.Our security department has te following questions : •            Are there plans to upgrade the Java version to the newest version? •            Is the installation of Adobe Reader/Writer a part of the global installation?•            Is the installation of Adobe Flash a part of the global installation? Hopefully somebodey can answer the questions. with kind regards, John van der KleijnFunctional manager GISMunicipality Eindhoven