OpenNMS Horizon 33.1.1 (Powderpuff)

Release 33.1.1

Release 33.1.1 contains bug fixes, security updates and new features.

The codename for Horizon 33.1.1 is Powderpuff.

Note: Minion and OpenNMS must be on the same minor version because of changes introduced in NMS-16543.

Bug

• 500 Server Error when sending events from GUI when OpenNMS has large number of Events configured (Issue NMS-16485)
• Provisioning fails when category has been deleted (Issue NMS-16536)
• With use-address-from-varbind traps are misassigned (Issue NMS-16543)
• Update protobuf (Issue NMS-16636)
• Update fop-core (Issue NMS-16961)
• Update cxf-core (Issue NMS-16962)

Task

• DevOps: Stop including ALEC in containers (Issue NMS-16576)

Enhancement

• Enable snmpinterface meta-data to be exposed in the time series integration layer for Pollerd metrics where possible (Issue NMS-16946)

New Feature

• PTP implementation: Implement poller to check for desired port state (Issue NMS-16956)
• PTP implementation: add documentation (Issue NMS-16957)

Story

• Include service status Integration API (Issue NMS-16972)

OpenNMS Horizon 33.0.10 (Downy Serviceberry)

Release 33.0.10

Release 33.0.10 contains a bunch of security updates, bug fix and enhancements.

The codename for Horizon 33.0.10 is Downy Serviceberry.

Bug

• Grafana reports endpoint failure (Issue NMS-16367)
• Version in about page points to invalid release notes (Issue NMS-16482)
• Structured Node List - some IP are missing (Issue NMS-16483)
• Installation instructions are broken and show an unresolved variable (Issue NMS-16490)
• Search does not return any results for Asset Search string Meridian 2024.1.3 (Issue NMS-16510)
• OpenNMS RESTful API provides incorrect URL in GUI after SSL enablement (Issue NMS-16530)
• Test case failures org.opennms.features.newts.converter. numeric value is NaN (Issue NMS-16936)
• Test case failures: The markup in the document preceding the root element must be well-formed (Issue NMS-16949)
• Logging in TcpListener in Eventd is done with a foreign class (Issue NMS-16951)

Task

• Replace babel/polyfill with core-js 3 (foundation-2021 branch) (Issue NMS-16477)
• Update dnsjava to version 3.6.0 if applicable (Issue NMS-16506)
• Update proton-j to 0.34 or latest for OSGI (Issue NMS-16549)
• Resolve jsoup version discrepancy seen in the dependency graph (Issue NMS-16552)
• Update Snakeyaml for indirect dependencies (Issue NMS-16570)
• Include nodeParentId in Rest API V2 returns for Node (Issue NMS-16571)
• Update linux UBI version to address security vulnerabilities (Issue NMS-16587)

Enhancement

• Add Node Labels to timeseries data for pollerd services (Issue NMS-16497)
• Adding resourceLabels to TS data (Issue NMS-16498)

OpenNMS Horizon 33.0.9 (Devilwood)

Release 33.0.9

Release 33.0.9 contains a bunch of security updates, bug fix and an enhancement.

The codename for Horizon 33.0.9 is Devilwood.

Task

• Update grpc to to the next version to address CVEs (Issue NMS-16180)
• Update org.apache.kafka:kafka to version 3.6.2 or higher. (Issue NMS-16507)
• Purge jettison 1.4.x from the system directory (Issue NMS-16513)
• Update BouncyCastle bcpkix to 1.78 (Issue NMS-16514)

Bug

• Usage statistics reporter throws an NPE in the stdout on startup (Issue NMS-16435)

Configuration

• Need to Update the Example Event Forwarder Script (Issue NMS-16501)

OpenNMS Horizon 33.0.8 (Golden Shower tree)

Release 33.0.8

Release 33.0.8 contains a bunch of bug fixes and an enhancement.

The codename for Horizon 33.0.8 is Golden Shower tree.

Task

• Alarm Resync (Issue NMS-16489)
• Update to Netty 4 (Issue NMS-16496)
• Update pgjdbc to version 42.5.5 (Postgres sql JDBC driver) (Issue NMS-16503)
• Update forked version of nekohtml parser to `>= 1.9.22.noko2`version of Nokogiri if applicable (Issue NMS-16504)
• Update Apache CXF to 4.0.4, 3.6.3 or 3.5.8 to fix CVE-2024-28752 (Issue NMS-16505)

Bug

• Snakeyaml vulnerable to Stack overflow leading to denial of service (Issue NMS-15169)

OpenNMS Horizon 33.0.7 (Pink powder puff)

Release 33.0.7

Release 33.0.7 contains a bunch of security updates.

The codename for Horizon 33.0.7 is Pink powder puff.

Bug

• Stored XSS on "Monitoring Locations" (Issue NMS-16443)
• Host Header Injection (Issue NMS-16450)
• [Web] - Missing Secure Flag on Session Cookie (Issue NMS-16451)

OpenNMS Horizon 33.0.6 (Mango)

Release 33.0.6

Release 33.0.6 contains a couple of bug fixes and an enhancement.

The codename for Horizon 33.0.6 is Mango.

Task

• Stalled threads in telemetryd parser (Issue NMS-16243)

Bug

• Cross-Frame Scripting-CWE ID : 1021 Web scan vulnerability (Issue NMS-16369)
• Address CVE-2020-15522 (Issue NMS-16384)
• Querying Alarms by alarmId leads to a page that loses context on refresh (Issue NMS-16417)
• NMS-16243 fix missing from 33.x release series (Issue NMS-16441)
• Stored XSS on "MIB Compiler" (Issue NMS-16444)
• Stored XSS on "Scheduled Outages" (Issue NMS-16445)
• Missing Access Control on "Grafana Endpoints" (Issue NMS-16446)
• Missing Access Control on "Geocoder Configuration" (Issue NMS-16447)
• Stored XSS on "Node Label" (Issue NMS-16448)
• Detailed server configuration in the error (Issue NMS-16449)
• Services are deleted and recreated on each provisioning run (Issue NMS-16458)

OpenNMS Horizon 33.0.5 (Black Pine)

Release 33.0.5

Release 33.0.5 contains a bug fix and an enhancement.

The codename for Horizon 33.0.5 is Black Pine.

Enhancement

• Update Provisiond scan to remove old primary IP inteface (Issue NMS-16347)

Bug

• Unable to set collection on detectors (Issue NMS-16360)

OpenNMS Horizon 33.0.4 (Anacahuita)

Release 33.0.4

Release 33.0.4 contains a bunch of bug fixes and enhancements.

The codename for Horizon 33.0.4 is Anacahuita.

Bug

• PostgreSQL monitor url parameter metadata cannot be resolved properly and collection fails consequently (Issue NMS-16374)
• Unable to display varbind’s form feed characters and other control characters in events (Issue NMS-16395)

Enhancement

• Allow fix-permissions and update-package-permissions scripts to set ownership for customized users (Issue NMS-16406)

OpenNMS Horizon 33.0.3 (Weeping European Beech)

Release 33.0.3

Release 33.0.3 contains a number of bug fixes and a documentation update.

The codename for Horizon 33.0.3 is Weeping European Beech.

Bug

• Running the config-tester -a throws an IllegalStateException for ActiveMQ context (Issue NMS-16355)
• CVE-2024-3094 investigation (Issue NMS-16396)
• Container image build fails with a wrong reference to deploy-base:ubi9-3.3.0.b265-jre-17 (Issue NMS-16399)

OpenNMS Horizon 33.0.2 (Old Man’s Beard)

Release 33.0.2

Release 33.0.2 contains a bunch of bug fixes and enhancements.

The codename for Horizon 33.0.2 is Old Man’s Beard.

Bug

• Access Denied when deleting a node with admin user (Issue NMS-15746)
• Device config upload failed with org.apache.sshd.common.SshException: EdDSA provider not supported (Issue NMS-16131)
• Event parameters with <> not rendering in event/alarm views (Issue NMS-16157)
• Hikari CP leaking threads (Issue NMS-16345)
• LdapMonitor does not work when a Minion is the poller (Issue NMS-16349)
• The script showing the Karaf process status in our container image requires "ps" (Issue NMS-16356)
• VMware credentials exposed in provisiond log file (Issue NMS-16357)
• Collectd can’t persist time series data and throwing a NPE with "java.util.List.size()" because "rraList" is null (Issue NMS-16358)

Enhancement

• Update install script to clear Karaf cache (Issue NMS-16226)
• Add option to import-requisition command to block until import is done (Issue NMS-16343)
• Rename User Data Collection feature to Product Update Enrollment (Issue NMS-16353)
• Configurable option for Kafka Producer CollectionSet buffer size (Issue NMS-16366)