Esri has discovered a critical vulnerability in the ArcGIS Server component of ArcGIS Enterprise resulting in a Server Side Request Forgery (SSRF) issue when special steps are taken by someone with network access to the deployment. This can result in access to and control over other infrastructure resources by unauthenticated persons.
This can affect any deployment depending on the infrastructure and configuration and all customers are urged to install the appropriate patch as soon as possible. There are known exploit vectors in Amazon Web Services (AWS) which makes this issue particularly urgent for those deployments.
This security issue affects all supported versions prior to ArcGIS Server 10.8 on both Windows and Linux. As an ArcGIS Enterprise customer, we are notifying you about this security vulnerability in addition to regular online notifications on our blog and security site at trust.arcgis.com.
What You Need to Do Patches for all versions of ArcGIS Server from 10.4 through 10.7.1 have been released. Esri strongly recommends installing the relevant patch at your earliest possible opportunity. ArcGIS Server 10.8 already contains these fixes and is not affected.
All patches can be downloaded from the Esri Support website where more information is also available.
You may also use the Patch Notification Tool to download and install the appropriate patch. Please see the software documentation for how to use this tool. Ensure that the patch is installed on all ArcGIS Server machines.
Keeping track of your ArcGIS Online accounts has just been made a little easier on My Esri. We’ve added a View ArcGIS Online page to the Licensing tab.
From this page, you can select the ArcGIS Online accounts associated with your organization and see the remaining credits, activation and renewal dates, subscription type, and the overall status of the subscription. You can also keep track of the membership within the selected ArcGIS Online subscription and the available licenses associated with it.
The page is for viewing your organization’s ArcGIS Online subscriptions. Activating a subscription will still need to be done through ArcGIS Online. But, we have provided a link on this page that will let you link your ArcGIS accounts to make it simple to switch between My Esri and ArcGIS Online.
We’ve added a new feature to help in the licensing and installation process. You may have noticed some additional information that has been added to the license file email:
This link will take you to a new page (you do need proper permissions) we have added with an overview of the license file that was created that includes the applicable downloads that are available for the products in the file.
This page is also accessible using a new button we’ve added to the License Files Details page if you need it:
Here is an overview of some of the updates we’ve made to My Esri in an effort to make things easier to use and find on the site.
Updates to the Additional Licensing Forms page
We’ve updated the Additional Licensing Forms page by rearranging some of the links to eliminate blank space and changing the order of things to make them easier to find.
New report of Portal and ArcGIS Pro license files
We’ve added a report of Portal and ArcGIS Pro license files to coincide with the files lists we have in the Manage
License Files link on the Licensing tab.
Fewer required fields in License Esri Products
We’ve changed the phone number, state, and postal codes fields in the End User Information step in License Esri Products to not be required fields.
Add tags to existing license files
Now that we’ve added the ability to tag license files (if you have the proper permissions) we got feedback that you’d like to add tags to files you had already created. So, we’ve added that ability in the Manage License Files Details pages.
There are a couple of changes that have been implemented to make managing your license files easier.
Manage License Files
On the Manage License Files page where there used to be a separate link to get you to your files for Portal and Pro, we’ve made the path to those files more prominent on the page. When you land on the page you will now see two cards with buttons that will take you to either your Enterprise and Desktop files or your Portal or Pro files:
Edit License Files
With the release of ArcGIS Enterprise 10.7 User Types we’ve added a feature where you can edit a license file you’ve created. This will allow you to update the quantity of User Types and Apps you have on a file without having to first cancel the file and wait for the quantities to become available again.
Note: At this point, the edit functionality is only available for files where 10.7 User Types and Apps have been allocated and have not already been cancelled.
To edit the file, go in to the ‘Details’:
And click on the ‘Edit Licensing File’ button:
You will then be brought to Step 2 in the original License Esri Products workflow where you can add and remove quantities to your allocation. Once you’ve completed the workflow you can generate the new file.
Note: Editing the file will cancel the original file and create a new one. So, in the Manage License Files list you will see the original file with a ‘Cancelled’ status along with the new file you created in the Edit Licensing File workflow.
With the release of ArcGIS Enterprisie 10.7, we took the opportunity to adde some new licensing features in My Esri to help our overall efforts to make this process easier. Please take a look at this video to see these features in action as well as gain knowledge on how to license ArcGIS Enteprise 10.7 in My Esri.
We’ve added a few features to the Licensing page to help us in our ongoing goal to make the licensing process simpler and more convenient to use.
License File Configurations
We’ve added a button to the License Esri Products workflow that allows you to save a configuration for files that you make multiples of, so you don’t have to keep going back and forth through the process.
The button shows up in all the steps of the process to allow you to create a configuration however you choose.
Once you’ve saved the configuration you can go to the Manage License File Configurations link to use it again or delete it if you no longer need it. You can also make changes to a configuration and save it or create a new, separate configuration.
License File Tags
We’ve also added the ability to tag license files to allow you to designate who the file is for, what department, location, etc. Any label you need to add to a license file can be added by tagging it.
To give you more control over the tags that are created for your organization there is a permission set up to allow whoever you designate to create, edit, or delete tags. If you have this permission turned on you will see a ‘Manage License File Tags’ link. From that link you can add a new tag.
You will also see a list of tags and how many license files that tag is used in. From here you can make edits to the tags or delete them.
Once you’ve created a tag is will be available to use in the License Esri Products workflow for your organization. You can also create tags from here if you have the Manage License File Tags permission turned on.
Historically, Esri provided an additional 30-day grace period for the first-year maintenance of perpetual licenses of some Esri products. This grace period was to allow for shipping time when Esri primarily delivered software on physical media.
This grace period was only for the first year of maintenance of perpetual licenses; subsequent years did not include a grace period. Term licensing also does not include a grace period.
Since all Esri software is now delivered digitally, and to make it easier for customers to line up their purchases of perpetual and term licenses, Effective April 1, 2019, we are eliminating this grace period for initial purchases of the following Esri software:
ArcGIS Data Appliance
ArcGIS StreetMap Premium
ArcGIS Business Analyst, Desktop, and Enterprise
Customers currently on their initial year of maintenance will maintain the 30-day grace period. Please contact your account manager, Esri Customer Service, or your local distributor for further information.
In our next release scheduled for March 6th we will be adding a feature to the License Esri Products workflow that will allow you to add tags to better help identify files. You can add tags to assign a file to a specific person, location, or functionality as an example.
In preparation for the release of the licensing tag feature we have added a new permission to My Esri to allow users to manage these tags. You should now see a ‘Manage Licensing Tags’ permission grouped with the ‘View licensing information’ and ‘Take licensing actions’ permissions.
Turning this new permission on will allow users to create and edit licensing tags for your organization once the functionality is released. We’ve added the permission now so when the new functionality is turned on your organization will be ready to implement licensing tags.