|
<Past |
Future> |
| 2.33.x |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
| 2.36.x |
Authorized w/ Constraints [1, 2, 3, 4, 5] |
Authorized w/ Constraints [1, 2, 3, 4, 5] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
| 2.43.x |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
| 2.45.x |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (DIVEST) [2, 3, 4, 5, 6] |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
| 2.46.x |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
Authorized w/ Constraints [2, 3, 4, 5, 6] |
| Note: |
At the time of writing, version 2.46.855 (Win) is the most current version, released 11/03/2025. At the time of writing, version 2.46.660 (Mac) is the most current version, released 11/03/2025. |
| | | | [1] | Users must ensure that Firefox, Google Chrome, and Microsoft Edge are implemented with VA-authorized baselines. (Refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Users should not utilize Bitmap Image File (BMP), as it is divested for use on the TRM.
Per the Security Assessment Review, users must abide by the following constraints:
- System Administrators must ensure authorized version of Json.NET is being used on Department of Veterans Affairs assets.
- System Administrators must ensure authorized version of Microsoft Visual C++ Redistributable is being used on Department of
Veterans Affairs assets.
- System Administrators shall monitor the .exe file used by the application with a file integrity checker to ensure no unauthorized
changes occur.
- Due to potential information security risks, SaaS/PaaS solutions must complete the Business Integration and Outcomes Service
(BIOS) process where a collaborative effort between Demand Management (DM), Enterprise Program Management Office
Information Assurance (EPMO IA), Digital Transformation Center (DTC), Enterprise Cloud Solutions Office (ECSO), Chief Technology
Officer (CTO), and stakeholders determines the SaaS/PaaS category during the Discovery Phase. All SaaS and Non-AWS or
Azure (VAEC) PaaS assets are routed to EPMO IA for Analysis and Approval to Operate (ATO) with technical oversight, acquisition,
production, and sustainment provided by DTC.
- Open firewall rules shall be locked down to specific IP addresses and/or ports or removed. System Administrators will need to verify
with the vendor if removing the firewall exception may impact the functionality of the application.
| | | [2] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | | [3] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | | [4] | Due to potential information security risks for cloud-based technologies, users should coordinate closely with their facility ISSO for guidance and assistance on cloud products. If further guidance is needed contact the Enterprise Cloud Solution Office (ECSO), which is the body responsible for new software development in and migration of existing systems to the VA Enterprise Cloud (VAEC) and ensuring organizational information, Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive data are not compromised within the VAEC. For information about Software as a Service (SaaS) products or to submit a SaaS product request, visit the Product Marketplace. (Ref: VA Directive 6004, VA Directive 6517, VA Directive 6513 and VA Directive 6102). | | | [5] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. | | | [6] | Users must ensure that Firefox, Google Chrome, and Microsoft Edge are implemented with VA-authorized baselines. (Refer to the ‘Category’ tab under ‘Runtime Dependencies’)
Users should not utilize Bitmap Image File (BMP), as it is divested for use on the TRM.
Per the Security Assessment Review, users must abide by the following constraints:
- A vulnerability exists because the software employs the use of the following
Open-Source Software (OSS): Json.NET ver. 4.5.11.15520. Json.NET ver.
4.5.11.15520 is unapproved within the Department of Veterans Affairs. To
mitigate, System Administrators must ensure an approved version of
Json.NET is being used on Department of Veterans Affairs assets.
- A vulnerability exists because Genesys Cloud Desktop employs the following
software: Microsoft Visual C++ 2015 Redistributable (x86) ver. 14.0.23026.
Microsoft Visual C++ 2015 Redistributable (x86) is in Divest status within the
Department of Veterans Affairs. To mitigate, System Administrators must
ensure approved version of Microsoft Visual C++ Redistributable is being
used on Department of Veterans Affairs assets.
- A vulnerability exists because Genesys Cloud Desktop installs .exe file
without a digital signature. This prevents the verification of the control`s
publisher and assurance that it has not been tampered with since being
published. To mitigate, System Administrators shall monitor the .exe file used
by the application with a file integrity checker to ensure no unauthorized
changes occur.
- A vulnerability exists because Genesys Cloud Desktop employs the use of
cloud services. Due to potential information security risks, SaaS/PaaS
solutions must complete the Business Integration and Outcomes Service
(BIOS) process where a collaborative effort between Demand Management
(DM), Enterprise Program Management Office Information Assurance (EPMO
IA), Digital Transformation Center (DTC), Enterprise Cloud Solutions Office
(ECSO), Chief Technology Officer (CTO), and stakeholders determines the
SaaS/PaaS category during the Discovery Phase. All SaaS and Non-AWS or
Azure (VAEC) PaaS assets are routed to EPMO IA for Analysis and Approval
to Operate (ATO) with technical oversight, acquisition, production, and
sustainment provided by DTC.
- A vulnerability exists because a firewall rule was added to any/any (local
IP/remote IP) with undefined ports for “windows_ie_ac_001” which was added
during the installation of Genesys Cloud Desktop. To mitigate, open firewall
rules shall be locked down to specific IP addresses and/or ports or removed.
System Administrators will need to verify with the vendor if removing the
firewall exception may impact the functionality of the application.
- A vulnerability exists because Genesys Cloud Desktop prompts the user to
check for automatic updates when launching it initially. To mitigate, System Administrators shall monitor versioning of Genesys Cloud Desktop to ensure
the approved version is in use on Department of Veterans Affairs assets.
|
|