Release Notes

Starting from v5.9.0, MetaDefender ICAP Server now performs File Type Verification before sending files to MetaDefender Core for processing. This helps reduce the MetaDefender Core load by filtering unnecessary files before scanning (see Allow list).

Note: To enable the Allow List feature on Rocky Linux 9.x / Red Hat 9.x, users must install libnslmanually (see Other software requirements)

Support for new email notifications for:

• MetaDefender Core connectivity with MetaDefender ICAP Server

• Hard disk usage exceeding defined threshold

Upgraded third-party libraries for improved security:

• libxml2 2.13.8
• PostgreSQL 16.8.0

• Filter workflows based on request body size
• Support for using Basic Authorization to override usernames in Processing History
• Enhanced speed for UDP syslog server via DNS name caching
• Export/import configuration per workflow
• Automatic license synchronization and updates with Activation Server

• Resolved an issue where the ICAP parser returned bad request in preview mode over slow network
• Fixed database connection failure when passwords contained special characters, after upgrading to v5.8.0
• Addressed various UI cosmetics issues and minor fixes

In MetaDefender ICAP Server v5.5.0, users cannot create a new SAML directory via the web UI.

• Workaround: Use REST API to create the SAML directory.
• Impact: Existing SAML directories are not affected when upgrading to MetaDefender ICAP Server v5.5.0
• Resolution: This issue is resolved in MetaDefender ICAP Server v5.5.1 and newer.

MetaDefender ICAP Server 5.1.0 or newer may encounter stability issues on Red Hat / Cent OS systems running kernel version 372.

Solution: Upgrade to kernel version 425, where Red Hat has resolved this issue.

Starting with MetaDefender ICAP Server v5.1.0, OpenSSL 1.x has been replaced with OpenSSL 3.x -- across the product and its dependencies -- to enhance security and address vulnerabilities.

As part of this upgrade, NGINX's OpenSSL 3.x on MetaDefender ICAP Server now enforces stricter cipher policies and rejects all weak cipher suites. The web server now only accepts "HIGH" encryption cipher suites https://www.openssl.org/docs/man1.1.1/man1/ciphers.html (MD5 and SHA1 hashing based are also not accepted).

As a result, if you already configured MetaDefender ICAP Server for HTTPS using a weak SSL cipher with your certificate, the server will not start due to the enforced security policies in NGINX's OpenSSL 3.x.

MetaDefender ICAP Server v5.1.0 on Debian OS must execute the two following commands to enable TLS when connecting to MetaDefender Core:

sudo mkdir -p /etc/pki/tls/certs/

sudo ln -s /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt

Resolution: Upgrade to MetaDefender ICAP Server v5.1.1, where the issue is resolved.