Release Notes 2024

This Application version is incompatible with Host builds 22.0.862 and earlier. You must upgrade to Host build 22.0.893 or later to stay within compatible versions. Selecting the Update Now button in the Admin Console while on an incompatible build may break your instance.

New Features and Enhancements

Web Print comes enabled by default for those with the Off-Network Print feature enabled. PI-62471

Feature Removed

Vasion deprecated the Control Panel Application (CPA) v1 from the Virtual Appliance solution. In this and future builds, the legacy feature is no longer available for installation from the Apps tab and CPA Manager, and has been removed from our online documentation. For some manufacturers, both CPA v1 and v2 appeared as installation options. All manufacturers now default to CPA v2 and no longer require the CPA v1/v2 selection.

Please reach out to our Support team with any questions. For a list of supported devices, refer to Supported Printers for Printer Apps.

Security Highlights

This security patch remediates the following vulnerabilities:

• V-2024-017 — Unauthenticated APIs
• V-2024-022 — Insecure Installation Credentials
• V-2024-024 — Insecure Communication to Printers & Microservices
• V-2024-025 — Hardcoded SSL Certificate & Private Keys
• V-2024-026 — Server Side Request Forgery
• V-2024-027 — Insecure Secure Shell (SSH) Configuration
• V-2024-028 — Unauthenticated Admin APIs Used to Modify SSL Certificates
• V-2024-029 — No Authentication Required to Modify Devices
• V-2024-030 — Exposed Internal Docker Instance (LAN)
• V-2024-031 — Local Privilege Escalation
• V-2024-032 — Server Side Request Forgery (SSRF)
• V-2024-033 — Server Side Request Forgery (SSRF)
• V-2024-034 — Server Side Request Forgery (SSRF)
• V-2024-035 — Server Side Request Forgery (SSRF)
• V-2024-036 — Server Side Request Forgery (SSRF)
• V-2024-037 — Server Side Request Forgery (SSRF)
• V-2024-038 — Server Side Request Forgery (SSRF)
• V-2024-039 — Server Side Request Forgery (SSRF)
• V-2024-040 — Server Side Request Forgery (SSRF)
• V-2024-041 — Server Side Request Forgery (SSRF)

For more details refer to Security Bulletin.

Vasion constantly works to maintain and improve security measures within the software. A security update within this release of the Virtual Appliance provides the option to further restrict allowed cipher suites. To enable additional restriction of cipher suites, add SSL_ENABLE_NIST_RSA_TRANSITION=0 to the secrets.env file within the shared storage of your Virtual Appliance.

With this entry, the Virtual Appliance only supports the following ciphers:

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_AES_128_GCM_SHA256
• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384

Fixes

• Improvement to the password creation process in the Virtual Appliance configuration utility. PI-62370
• Configuration utility verbiage changes to present the CIDR documentation clearly. PI-62721
• IdP communication improved to resolve an authentication issue. PI-62755
• Improved the tree structure for increased performance with large tree structures. PI-61288
• Enhancement to the inherited assignment logic for Internal Routing Service and External Gateway. PI-62778
• Improvement to the migration process to resolves issues seen with identities and Admin Console logins. PI-63103 / PI-62651
• Simplified Scanning settings persist after upgrading to a new build. PI-61772
• Improvement to the Off-Network Print service to self-recover from critical errors. PI-60235
• Internal routing service enhancement regarding certificates. PI-62276
• Optimization of Service Client setting routes. PI-61369

This Application version is incompatible with Host builds 22.0.862 and earlier. You must upgrade to Host build 22.0.893 or later to stay within compatible versions. Selecting the Update Now button in the Admin Console while on an incompatible build may break your instance.

Security Highlights

Remediated the following vulnerabilities:

• V-2024-018 — RCE & Leaks via API
• V-2024-019 — Encryption Key Exposure
• V-2024-020 — Remote Code Execution
• V-2024-021 — Inadequate Secure Configuration Documentation
• For more details refer to Security Bulletin.

Vasion constantly works to maintain and improve security measures within the software. A security update within this release of the Virtual Appliance disables weak ciphers by default. This change may disrupt printing for older printer models that use weak ciphers.

Please review the information below before upgrading to the new builds.

New Features and Enhancements

New Feature: Web Print

• Description: Guests, contractors, and students can now securely upload and print documents to managed printers directly from a web browser. For more details refer to Web Print.

New Feature: Epson CPA v2

• Description: Control Panel Application (CPA) officially supports Epson multifunction device (MFD)! This update unlocks powerful features for Epson users like Scan to Email and Secure Release Print. For more details refer to Epson CPA 2.0.

New Feature: Scan To Email

• Description: Scan To Email is a new feature that offers a consistent user interface for scanning documents and having them sent to an email address. Scan To Email is the first of Vasion's Scan To options to be released. Scan To Email is available as core functionality. More information can be found in the Scan to Email topic.

New Setting: Restrict Release Portal Access

• Description: This setting prevents end users from directly releasing their held jobs via the portal if the company policy requires them to be physically present at the printer to do so. This feature enhances security by ensuring that end users must walk up to the printer to release their jobs, reducing the risk of print jobs being intercepted or accessed by unauthorized individuals. For more details refer to Virtual Appliance Portals.

New Setting: Automatically check for tree updates during navigation

• Description: The tree structure automatic update feature enhances performance and gives users greater control over when the tree structure updates. For more details refer to Tree Structure.

Removed Setting: The “Enable Group Membership Sync” option for Identity Sync has been removed from the Admin Console. This feature led to unnecessary syncing of group memberships, which increased storage use. With this change, only relevant group memberships are synced, reducing data load and improving system performance. For more details refer to Identity Sync.

Fixes

Admin Console

• The "Functionality limited..." message for Pull Print only displays if an identity provider has not been configured in the environment. PI-51840
• The New button and context menu option are grayed out after selecting a printer, IP Address Range, or Service Client object. PI-53530 / PI-53531
• Non-administrator roles only see the printers they are assigned to when they export the TCP/IP Printer option in the Data Manager. PI-55517
• Custom roles with View access to the printer object Apps tab show the configuration fields rather than a blank screen. PI-57523
• The CPA authentication setting "Require Pin (beta)" unchecks after the parent setting is disabled. PI-58168
• When the Enable "Automatic Self-Service Portal and Release Portal" login setting on Tools Settings Portal is disabled, portal security based on IP Address Range is not supported. PI-58429
• You can configure multiple Custom Fields at once without being redirected to the main Admin Console page. PI-58526
• Saving changes on the Portal Settings page works correctly and doesn't give a false error message. PI-58581
• The Admin Console UI displays all folders in large tree structures with the screen view set to 100%. PI-58780
• Non-administrator roles can add users to portal security and printer deployments in folders they have access to. PI-59861
• The Driver / Profile Repository displays the correct options and buttons after selecting a driver. PI-60140
• The Printer Apps tab loads correctly in the Admin Console. PI-60306
• Printers added using Windows Print Server Links display correctly in the Admin Console tree structure. PI-60594
• The Email Printing "Test SMTP Connection on next check-in" option unchecks the test checkbox after completing the SMTP test. PI-61138
• Multiple badges may be deleted using the Badge Management tab. PI-60165

IdP

• An improvement to the IdP login process that fixed a false "The server returned an invalid response" error displaying during login. PI-51010
• The authentication setting "Use Domain User (Windows only)" works correctly on Azure domain joined machines. PI-58010

Control Panel Application (CPA)

• Improvement to the Ricoh CPA v2 that fixes the native scanning pop-up from locking up the app. PI-56876
• Badge scanning on the Ricoh CPA v2 devices works correctly on the first badge scan and doesn't require a second swipe. PI-58977
• Improvement to CPA v2 that resolved a connection lost error with the UI after the devices sat overnight. PI-59454
• Improvement that resolved multiple Copy icons appearing on Konica Minolta printers with CPA v2 installed. PI-60180
• The Konica Minolta flex URL functions correctly with CPA v2. PI-61178
• Scanning jobs in portrait mode on Xerox CPA v2 correctly rotates the document. PI-58885
• Release Portal timestamps on CPA v2 show the correct times instead of UTC-9. PI-59615
• Ricoh devices retain the single sign-on (SSO) Provider mode settings after sitting overnight. PI-55805

Reports

• The Administrative Audit Records report displays the correct data rather than a blank screen. PI-60221
• Scheduled Reports send correctly using an SMTP configuration that does not require authentication credentials. PI-61069

Self-service Portal

• The Authentication menu items on the Self-service Portal display correctly after the initial login. PI-59255

Service Client & Services

• The Service Client functions correctly in environments using PAC files. PI-57496
• Improvement to the Service Client check-in and settings sync. PI-60237
• Improvement to the API Print Service that ignores non-required body elements. PI-61188
• Improvement to the Output Automation service that reduces CPU utilization. PI-57432
• The Offline Secure Release Print service no longer deletes print jobs after updating. PI-60340
• Improvement to the Off-Network Print service for use with Virtual Appliance certificates. PI-61090

This Application version is incompatible with Host builds 22.0.862 and earlier. You must upgrade to Host build 22.0.893 or later to stay within compatible versions. Selecting the Update Now button in the Admin Console while on an incompatible build may break your instance.

Security Patch: This build includes resolutions for recent vulnerabilities within the Virtual Appliance. Vasion urgently recommends upgrading to Host Build 22.0.1002, which includes Application Build 20.0.2614, to maintain a secure environment.

Security Highlights

Remediated the following vulnerabilities:

• V-2024-012 — SQL Injection
• V-2024-013 — Hardcoded Password
• V-2024-014 — Outdated Dependencies
• V-2024-015 — Privilege Escalation
• V-2024-016 — Cross-Site Scripting
• For more details refer to Security Bulletin.

Security Enhancement: The About PrinterLogic page on Support & Training About PrinterLogic contains the Update Now or Update from File options for updating the Application version of the Virtual Appliance. Access to this page has been restricted to specific roles assigned on the Tools Users page.

Impact to Roles

The Administrator and Site Manager roles include this permission by default. Users assigned to this role won't experience a change.

The Deploy Manager, Help Desk, Print Job Report Manager, and Administrative Auditor roles exclude this permission by default. Access to the About PrinterLogic page remains, but the Update Now and Update from File buttons do not display for these roles.

Security Highlights

Remediated the following vulnerabilities:

• CVE-2024-21626
• V-2024-002 — Addition of Partial Admin Users Without Authentication
• V-2024-003 — Cross Tenant Password Exposure
• V-2024-001 — Edit User Account Exposure
• For more details refer to Security Bulletin.

New Features and Enhancements

New Feature:API Print Service.

• Description: The API Print Service gives control back to print administrators using Epic or other LPD applications, allowing them to fully control their print environment. Doing so eliminates the need to install print queues on your source application altogether and allows moving to a driver-less print model, reducing the work required to maintain the print environment.
• There are two places you’ll need to configure settings for the API Print Service. In the Admin Console and inside your source applications administrative settings.

MySQL Update: This version integrates an updated MySQL server version. It is critical to create a backup of your database before updating.

This version does not support Linux Service Clients running the Printer Apps service.

Fixes

• Improved the responsiveness of the HP CPA v2. PI-53518
• Resolved a "Failed to get print job information" error showing for held jobs on Kyocera devices. PI-55175
• Improvement for Kyocera CPA v2 installations from Windows 2022 servers not running domain services. PI-54563
• SNMP v3 with a printer that does not have a Context Engine ID: pulls data as expected. PI-49289
• Improved Lexmark CPA v2 communication with the Virtual Appliance. PI-52697
• Removing Windows Print Server Links removes the printers as expected. PI-52053
• Print Job Records reports for subfolders display data as expected. PI-50403
• Enabling global Pull Print settings with an IdP configured no longer displays a "Functionality limited. LDAP settings should be configured for your domain(s)," error. PI-51840
• Resolved an extended authentication delay occurring on Toshiba CPA v2 with single sign-on (SSO) enabled. PI-53430
• Improvements to the tree structure and Service Client object context menu options. PI-51470