A security update for New Relic's .NET agent fixes a vulnerability where the agent could unintentionally capture service request parameters from WCF applications.
Release date: May 4, 2017
Vulnerability identifier: NR17-04
The following New Relic agent versions are affected:
|Name||Affected version||Notes||Remediated version|
|.NET agent||220.127.116.11 (and greater)||With WCF||6.11.613.0|
New Relic’s .NET Agent version 18.104.22.168 added visibility into Error Analytics. By default the agent will capture error events, and with WCF applications this is captured as event type TransactionError. New Relic has found that the service.request.* attributes may contain sensitive information that should not be sent to New Relic. A fix has been made to disable the collection of these parameters during the error collection. Customers are encouraged to upgrade to the latest version of the .NET agent.
- Only .NET agents with Error Analytics and WCF applications are affected.
- All service request attributes are disabled in High Security Mode.
Users who are affected and unable to upgrade may choose to manually configure the .NET agent to not capture service request parameters. Users can exclude service.request.* attributes from the errorCollector stanza in their newrelic.config file.
<attributes enabled="true"> <exclude > service.request.*</exclude> </attributes>
For details please refer to our .NET agent Error Collector configuration
Report vulnerabilities to New Relic
New Relic is committed to the security of our customers and their data. We believe that engaging with the security community is an important means of achieving our security goals, and we appreciate responsible disclosure of any vulnerabilities by security researchers.
If you believe you have found a security vulnerability in one of our products or websites, we welcome and greatly appreciate you reporting it to New Relic through one of these methods:
For more help
Additional documentation resources include:.