Version 5.7 (July 2023)

DIGIPASS Gateway supports direct upgrades from version 5.1 or 5.6 to version 5.7 on the supported operating systems.

Web servers

Description: Beginning with version 3.21, OneSpan Authentication Server forwards the correlation ID to the Message Delivery Component (MDC) service when a push notification is requested. MDC forwards the correlation ID to the OneSpan Notification Gateway.

In an on-prem-only deployment, where MDC forwards the request to the on-premises DIGIPASS Gateway instance, the correlation ID is received by DIGIPASS Gateway, but not processed or included in the trace file. This makes it difficult to troubleshoot issues in the push notification workflow.

Affects: DIGIPASS Gateway 5.4–5.6

Status: This issue has been fixed. DIGIPASS Gateway now provides a servlet filter (LogCorrelationIdFilter) to retrieve the correlation ID from a request and write it to the trace log file. By default, the filter is disabled and must be enabled via the deployment descriptor file (web.xml).

Description: DIGIPASS Gateway uses a Java property file to store configuration settings, including sensitive data, such as passwords to access proxy servers and API keys used for HTTP authentication. The values in the property file are stored in plain text.

Furthermore, the password and user name for proxy servers are incorrectly stored using the inverted property names, i.e. the user name is stored in the password property and vice versa.

Affects: DIGIPASS Gateway 5.0–5.6

Status: This issue has been fixed. The value of sensitive properties are now encrypted using a static software-level key by default. The property names are now used correctly. The OneSpan Web Configuration Tool that is used to maintain these property files only indicates whether those properties are set without displaying the actual values.

Since the default value encryption provides only basic protection, we recommend that you additionally restrict file access to the property file.

DIGIPASS Gateway no longer supports the following products:

Web servers