Security:

• Various security fixes. See PaperCut NG/MF Security Bulletin (March 2024) for more information. [CDSS-3505], [CDSS-3325], [PO-2080], [PIE-708], [PO-2030]
• This release also includes several pre-emptive security improvements and additions to layers of defense. These improvements were made as a result of code audits, pen tests and security reviews. Changes were made in line with our security uplift initiative.

Fixes:

• Addressed file traversal issues. [CDSS-2495], [PO-1447]
• Hardened internal API Authentication. [PO-1474]
• Updated third party libraries to recommended patch levels. [PO-1441]

Fixes:

• Addressed a Path Traversal vulnerability in the Application Server and Site Server. Under specific conditions, this could potentially allow an attacker read-only access to the server’s file system. CVE-2023-31046. [PO-1277]
• Addressed a Cross-Site Request Forgery (CSRF) vulnerability in the Application Server, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes. CVE-2023-2533. [PO-1366]

Fixes:

• Security improvements to address an issue identified as ZDI-CAN-18987 in the NG/MF Application Server and Site Server. [PO-1216]
• Security improvements to address an issue identified as ZDI-CAN-19226 in the NG/MF Application Server. [PO-1219]

Fixes:

• Fixed an issue that could cause an upgrade to fail when using version 21.2.9 with an MS SQL Server database. [PC-18810]

Other Notes:

• Note that this release includes the 3 security improvements listed in the previous release 21.2.9.

Fixes:

• Security improvements to address an issue in the Application Server. More information. [PC-18750]
• Security improvements to address potential Spring4Shell vulnerabilities in the Application Server. More information. [PC-18756]
• Security improvements to the Rhino.js scripting engine used with the Application Server. More information. [PO-816]

Other Notes:

• Note that this release has been removed from the website and from release archives, with a fix released in 21.2.10.

Fixes:

• Removed log4j 1.x dependencies from the PaperCut application install. Log4j 2.17.1 is now used exclusively. Note that customers upgrading from previous versions will also need to manually remove the /client/mac/legacy/PCClient.app application to avoid vulnerability scanners flagging this deprecated legacy client. [PO-725]

Fixes:

• Restored latest (2.17.1) versions of log4j2 libs accidentally reverted in previous release. [PO-785]
• Fixed an issue on Email To Print and Mobility Print where the printed page of the pdf file could be clipped. [PC-18698]

Enhancements:

• Added the tbl_printer_usage_log, table tbl_print_hardware_check, and tbl_refund_request tables to the list of tables that can be purged with db-tools. [PO-73]

Fixes:

• Fixed an issue that caused account balance adjustment to be off by a very small amount because of rounding issues. [PO-706]

• Fixed an issue that prevented device type filtering on the Devices page from working. [PO-655]

• Added a new config key (user.card.pin.hash-encode) to control whether user PINs will be hashed encoded and therefore unrecoverable. Default is ‘Y’. Set to ‘N’ if you are using the PaperCut Toshiba V2 and use PINs for login, to prevent user PINs from being hash encoded. [PO-540]

• Fixed an issue that could cause PDFs printed via Mobility print to fail to print “i” characters that were adjacent to “f” characters. [PO-236]

• Fixed an issue on macOS and Linux that could cause the number of copies made to be incorrect (number would be the square of the correct number). [PO-710]

• Fixed an issue with the Network Payment API that could cause top-up amounts to be calculated incorrectly in some edge cases. [PO-439]

• Fixed an issue that could cause print script pop up windows to be incorrectly sized in relation to the text. [PO-735]

• Fixes a bug that caused the User Client to present a Low Balance Notification on launch when Low Balance Notifications for the User Client were disabled. [PO-594]

• Fixed an issue that caused the user associated with anonymous/guest login with email to print to always be set to unrestricted when settings are saved. [PO-724]

• Fixed an issue that could cause long-run copy jobs that were interrupted (e.g. to refill paper tray) to be ended prematurely by the copier. [PO-731]

• Payment Gateway

  • Fixed an issue that caused PaperCut to incorrectly notify the user that the PayPal transaction was canceled, after returning to the PaperCut interface from the PayPal payment gateway. [PO-604]

• Release Station (Windows):

  • Fixed a configuration issue that prevented the release station from running on Windows network share paths (e.g. \\server\PCRelease). [PO-611]

• Print Provider:

  • Fixed an issue that could cause Canon UFR data to be interpreted incorrectly, leading to the number of pages to be calculated incorrectly. [PC-18465]
  • FX Versant 180 Press GX230 PostScript printer driver: Fixed an issue that caused grayscale output to be incorrectly detected as color. [PO-618]
  • Brother PCL5 printer driver: Fixed an issue that caused the page size to be treated as A4 when printing on some other paper sizes (e.g. A5). [PO-662]

• Sharp OSA:

  • Fixed an issue that could cause a site server to fail to start a device when the app server device config changes had been made but not yet propogated to the site server. [PO-584]

• HP OXP:

  • Fixed an issue that caused Integrated Scan jobs sometimes fail and be charged for the failed job on HP devices where users had a very low balance. [PO-221]
  • Reduced database query frequency for some Sharp OSA related background operations. [PO-677]
  • Fixed an issue that could cause errors on HP OXP devices when switching between site and application servers. [PO-701]

• Ricoh SDK/J:

  • Removed Ricoh SDK/J v2 (deprecated) from the MF installs on Windows, Linux and macOS. [PO-727]

Other Notes:

• Updated Handlebars.js library to version 4.7.7. [PO-603]
• Upgraded internal Jetty server to version 9.4.44. [PO-228]
• Updated licensing information summary to say “Licensed devices & connectors” [PO-621]

Fixes:

• Fixed an issue that caused the Web Cashier username search field dropdown to not function correctly. [PO-513]
• Updated file naming convention for scanned files in PaperCut to include leading zero (0) characters up to three digits, where multiple pages are scanned using integrated scanning. This prevents pages from arriving out of order. [PO-10]
• Upgraded all log4j2 libs to v2.17.1 to remove any possible vulnerability to CVE-2021-44832.

Copier / Device Integration:

• Konica Minolta:
  • Fixed an issue with Konica Minolta devices where authentication with network card readers failed after upgrading to PaperCut version 21.1.1. [PO-583]

Fixes:

• Upgraded all log4j2 libs to v2.17 to remove vulnerability to CVE-2021-45105.

Fixes:

• Upgraded all log4j libs to v2.16 to remove vulnerability to CVE-2021-44228 (Log4Shell) and CVE-2021–45046.

New Features:

• Scan to Fax (Windows):
  • Added phonebook and multi-recipient support for Canon (Meap), HP OXP, Sharp OSA (HTML Browser n2.0+), Toshiba v3+, and Xerox (Secure Access EIP 1.5+). [PC-18398]
  • PaperCut MF’s Integrated Scanning solution provides a secure and simple way to fax documents. A growing number of Fax Providers using their proprietary APIs are available in PaperCut MF, this release we included Concord. [PC-18664] and eGoldFax (contact PaperCut for how to set this up)

Enhancements:

• Scan to Fax (Windows):
  • Konica Minolta devices: Added the ability to delete a recipient before sending a fax job. [PC-18447]
  • Ensure multi page fax documents maintain the correct page ordering. [PC-18656]
• Batch User Import:
  • Optimized to improve import times. [PO-573]
• Web Print:
  • Added the ability to detect password-protected Word documents and fail with a meaningful error message instead of waiting indefinitely. [PC-5325]
• Added password authentication support to the Standard Azure AD sync source. [PO-553]
• Improved Azure AD graph sync to now sync the users’ department. [PO-404]
• Changed the Health Check endpoint example to be a less expensive endpoint. [PO-276]
• Improved usability by removing the Azure ID configuration from the setup wizard to the Options > User Group Sync page. [PO-587]
• Added advanced config keys for the following, for which more information is available on request:
  • Hide the “Jobs” (Web Client) link in Mobile Print Release. [PC-18630]
  • Hide Mobile Print Release username and password authentication. [PC-18624]
  • Enable a custom program for resolving user card number lookups. [PC-17219]

Fixes:

• Batch User Import:
  • Fixed a bug that updated all database user records even when there was no data to update. [PO-567]
• Print Provider:
  • Fixed an issue that prevented PaperCut from detecting when Konica Minolta and Kyocera devices were out of paper. [PO-460]
  • Fixed an issue that caused the Print Provider to crash when certain PCL5 data was printed. [PO-561]
• Scan to Fax (Windows):
  • Fixed an issue where special characters in fax settings caused sending faxes to fail. [PC-18589]
• Fixed an issue that prevented users from logging on if their Network Payment Gateway balance was a whole number (for example, $10) instead of a number that included a decimal point (for example, $10.00). [PO-377]
• Fixed an issue that caused SNI host checking to still be active if both SNI host checking and HSTS were disabled. [PO-511]

Copier / Device Integration:

• HP (OXP)*:
  • Added auto page size detection when using Integrated Scanning on HP OXPd devices. Does not support auto-orientation. Please see limitations listed here. [PO-223]
• Xerox:
  • Resolved an issue with Xerox devices showing an error ‘Cannot communicate with authentication server’ when the username has more than 32 characters. [PO-434], [PO-448]
• Added new embedded platform FujiFilm Business. [PO-173]

Other notes:

• Devices marked with * require installing an updated version of the embedded software to access new features and fixes.

Enhancements:

• Improved editing experience when adding/modifying custom links in the user.web.custom-links config key. [PO-400]

Fixes:

• Fixed a Print Provider issue that could prevent job release when using “HideDocumentNames=on”. [PO-608]
• Improved device registration for HP OXP devices. [PO-337]
• Fixed an issue that caused the line numbers in the device script editor to mis-align with the text/code. [PO-442]
• When a new Cloud Services region is selected, a message displays telling the sysadmin that a PaperCut MF restart is required. [PO-428]
• Improved editing experience when adding/modifying custom links in the user.web.custom-links config key. [PO-474]
• Fixed an issue that could cause a device error when scanning if “Auto Mixed” or “Auto Same” paper sizes were selected. If mixed size is not available on the device, Auto Mixed and Auto Same options now default the paper size to the default for the PaperCut server region.[PO-462]
• Scan to Fax:
  • Fixed an issue that caused sending faxes with RightFax to fail due to case mismatches of the user email address in PaperCut MF and in RightFax. [PC-18560]
• PaperCut Global PostScript printer driver:
  • Fixed an issue that could have caused a document printed from Microsoft Office and some other products to be printed in color even though the “Black & White” output was set. This fix applies only when the color detection mode on the admin console is set to page-level. [PO-16]
• Toshiba v3+:
  • Fixed an issue that prevented the ‘proof copy’ flag from being recognised if turned on part way through copying. [PO-326]

New Features:

• Scan to Fax:
  • Konica Minolta: On advanced fax integrations, users can now search and select contacts from a phonebook or via manual entry. [PC-18363]

Enhancements:

• Scan to Fax:
  • Added the ability to encrypt Basic (Generic SMTP) Scan to Fax actions. [PC-18269]
  • Added the ability for Basic (Generic SMTP) to reject untrusted certificates. [PC18269]
  • Toshiba and Konica Minolta devices: Added the ability for these devices to support the new advanced ‘API-based’ fax integration with Retarus. [PC-18480]
  • Toshiba and Konica Minolta devices: Added the ability to allow/prevent Basic and Advanced Scan to Fax actions from appearing on the MFD. [PC-18459]
• Improved customization and flexibility. Added support for syncing custom attributes to the Card ID field when using Google Cloud Directory. [PO-180]

Fixes:

• Scan to Fax:
  • Authentication secrets are now hidden from the debug log. [PC-18389]
  • Added license warnings and per-device access to Scan to Fax actions. [PC-18329]
• For customers running a large number of Direct Print Monitor clients, we have optimised the Application Server performance to improve performance and scalability. [PO-219]
• Security improvements to address an issue in the NG/MF Application Server. [PO-480]
• ‘Sign in with Microsoft’ button no longer asks for consent from the user at every login. [PC-18419]

Copier / Device Integration:

• Kyocera: v3.1.3 *
  • Added support for auto-detection of scanned page sizes, including mixed-size scans on devices configured as metric only. [PO-283]
• HP (OXP):
  • Added control for whether or not the PaperCut OXP app registers as a quota service. The new config key is ext-device.hp-oxpd.register.quota-service. The default is Y, which maintains the behaviour of previous versions. [PO-350]
• Konica Minolta (OpenAPI):
  • Reduced app server load time during startup. [PO-169]

Other notes:

• Devices marked with * require installing an updated version of the embedded software to access new features and fixes.

Fixes:

• Security improvements to address an issue in the NG/MF Application Server. [PO-480]

Other notes:

• If you are running v21.0.1 or older, there is a database upgrade.

Enhancements:

• Added the capability to configure the maximum number of printers monitored by the Print Provider. [PO-373]

Fixes:

• Fixed compatibility issues with MySQL 8.0.23. [PO-336]
• Fixed an issue that could cause incorrect paper size selection when printing to a Sharp MX-3071 with PCL6 drivers. [PO-386]
• Fixed an issue that caused user sync tests to fail and ultimately to lock the app server. [PO-426]
• Security improvement: Fixed an issue that in some cases could cause session tracing via url rewriting to occur, if cookies were disabled in the user’s browser. [PO-388]

Other Notes:

• If you are running v21.0.1 or older, there is a database upgrade.

Enhancements:

• Added support to the webservices API for deleting delegated groups, delegated users and other email addresses. [PO-290]

• Added new substitution variables %device_name% and %device_location% to the available macros for integrated scanning destination paths. [PO-193]

• Added the new config property schedule.daily-maintenence-reports to allow scheduled reports to be run at a different time to the daily maintenance tasks. [PO-130]

• Added SSL support for PaperCut desktop client communications. [PO-50]

• Print Archiving:

  • Added support for latest GhostPDL executable naming convention on Windows, Linux/Unix and Mac. [PO-94]

Fixes:

• Fixed an issue for third party providers who have created a top up link using our Payment Gateway Module API; previously the user could have their account topped up 100x more than it should if one of the following three config keys were set and the top up amount was equal to one of these values - Min, Max and Default Transfer Amounts. [PO-282]

• Fixed an issue with the webservices API that did not support group lookups when using username aliases. [PO-263]

• Fixed an issue with LDAP user syncing that caused the domain component of UPN usernames to be appended twice when syncing with multidomain enabled, for sources other than GSuite. [PO-259]

• Fixed an issue that could cause web print to fail for images when .NET runtimes other than Standard are installed. [PO-181]

• Fixed an issue that prevented Unicode language names (e.g. Hebrew) from being displayed correctly in the file-based group import (additional-groups.txt). [PO-324]

• Fixed a Cross-Site Scripting vulnerability in the user import (from a TSV file). [PO-305]

• Removed authentication requirement from /verify page of PaperCut user interface so that new account verification links will still be usable when WebSSO is enabled. [PO-43]

• Updated Google OAuth libraries to version 1.35.0. [PO-15]

• Fixed an issue that caused the Scan Next Page button to be hidden on some devices with small screens. [PO-17]

• Fixed an issue that prevented OpenAPI logs from being generated. [PO-301]

• In cases where Shared Account access within PaperCut is defined by Active Directory Group Membership, the shared account access would not update on an Active Directory Sync. This update will now occur. [PO-262]

• Fixed an issue that caused color pages to be incorrectly detected as grayscale when printing from the iOS Photos app. [PO-217]

• FUJIFILM Business Innovation ART EX printer driver:

  • Fixed an issue that prevented page size and grayscale page detection from working. [PO-304]

Copier/Device Integration

• FujiFilm
  • Fixed an issue with newer models that caused the card reader to stop working when the device wakes up from standby. [PO-260]
  • Fixed an issue that caused the pages in multi-page JPG scans on Fuji devices to be ordered incorrectly. [PO-20]
  • Added support for closing the onscreen keyboard when the enter key is pressed on DMP-13 and 14 devices. [PO-147]
• HP
  • Fixed an issue that could cause PaperCut to clear the device access control settings at each re-initialisation of the integration, with firmware 4.11 and later. [PO-138]
  • Fixed an issue that occasionally caused HP FutureSmart 4 devices to lock up during integration process. [PO-46]
  • Added support for using multiple card readers in parallel on HP OXP devices. [PO-79]
• Konica Minolta
  • Fixed an issue that prevented some color pages from being correctly charged when using custom paper sizes for copy jobs on Konica Minolta. [PO-95]
  • Fixed an issue that caused device Back, Delete and Print buttons to be unresponsive when the config key ext-device.konica-minolta.browser.show-logout-button was set to .
• Xerox
  • Fixed an issue that prevented grayscale conversion from working with Xerox AltaLink models. [PO-72]
  • Added support for usernames longer than 32 characters, previously this could prevent users from scanning or copying if their username was longer than 32 characters. [PO-188]

Other Notes:

• If you are running v21.0.1 or older, there is a database upgrade.
• Devices marked with * require installing an updated version of the embedded software to access new features and fixes.
• 21.0.3 is a combination of all the changes in 21.0.2 as well as 21.0.3, due to timings the two releases were combined.

New Features:

• Scan to Fax (Windows):
  • PaperCut MF’s Integrated Scanning solution now provides a secure and simple way to fax documents. A growing number of Fax Providers using their proprietary APIs are available in PaperCut MF including RightFax, Xmedius, and GoFax. Support is also provided to use the SMTP protocol to communicate with other Fax Providers that are not directly supported. It’s secure and easy to set up and seamlessly integrates with the overall PaperCut MF experience. Note: Scan to Fax is available on most Integrated Scanning-enabled devices. However, for an enhanced experience with extra security and features, this is currently supported on Konica Minolta and Toshiba V3+. An active Premium Upgrade Assurance (PUA) subscription is required to use this feature. Linux and macOS support coming soon. [PC-18179]
• HP OXP enhanced workflow:
  • Added new enhanced workflow mode for HP OXP devices which can be enabled via a config key ext-device.hp-oxpd.enhanced-mode. This user workflow presents PaperCut login and directs user to PaperCut home screen. When disabled, user workflow presents PaperCut login and directs user to Device home screen. [PC-18107]

Enhancements:

• Updated environmental impact widget appearance. [PO-68]
• Upgraded the app server logging system to a newer version. [PO-63]
• The PaperCut Connector for Microsoft Universal Print is now included in the standard server installation. [PC-18287]
• Added alternative method for synchronizing and authenticating users with Azure Active Directory that no longer requires AD Domain Services. [PC-18120]
• Now include previously deleted users when running the redaction feature. [PO-77]
• Changed the unit measurements for environmental savings on the dashboard. [PO-65]
• Diagnostics files can no longer be uploaded to the cloud from MF. [PO-166]
• Added the card/ID numbers (primary and secondary) fields to the fields that can be redacted using our redaction feature. [PO-161]
• Add the name for any secondary personal accounts to the fields that can be redacted using our redaction feature. [PO-160]
• Added PDF/A conversion support for DocProc. [PO-56]
• The Admin web interface now displays the full version of each Site Server in the Sites area. [PO-133]

Fixes:

• Fixed an issue on Linux with pdftocairo that might cause an incorrect number of color pages to be detected. [PO-135]
• Updated Jetty to version 9.4.35.v20201120 for security reasons. [PO-41]
• New Behaviour for Mobile Release page /mr/(printerIdentifier) search. Previous behaviour was that if you entered /mr/(printerIdentifier) and it matched more than one printer, then it would display an error ‘failed to match’ and show all printers. New behaviour is that if your search matches more than one, it displays the printer list page pre-filtered to your search, if your search term is a full printer name that matches a single printer, then it will take you straight to the printer’s job page as it did previously. Allows users to store a bookmark which filters the release page by name/location/etc. which was not possible before. [PC-17411]
• Fixed an issue that could cause the Print Provider to crash parsing PCL5 data generated by SAP ERP. [PO-189]
• Fixed an issue when using certain Konica Minolta PCL6 printer drivers, printing on Tabloid (11x17) paper size with Email to Print or Web Print, that could cause the printer to print A4 or Letter size instead. [PO-182]

Copier / Device Integration:

• Toshiba V3+:
  • Added the ability for a user to select their preferred language at the MFD. [PO-75]
  • Fixed an issue on Toshiba devices with 3rd party applications alongside PaperCut requiring separate login instead of automatically being logged in when user logs in via PaperCut. [PO-202]
• Sharp OSA n2:
  • Added support for auto-detection of scanned page sizes, including mixed-size scans. [PO-69]
• Canon MEAP Gen3+:
  • Fixed an issue on Gen3+ devices that caused multi-page scans to JPEG to be delivered with the pages out of order. [PO-152]

Other notes:

• If you are running v20.1.3 or older, there is a database upgrade.
• Devices marked with * require installing an updated version of the embedded software to access new features and fixes.