> For the complete documentation index, see [llms.txt](https://docs.verifone.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.verifone.com/petroleum-docs/petro-and-c-store/pin-pads/release-notes/platform-release-notes.md). # Platform Release Notes ### EVPAY Versions The following versions include the Platform Enhancements in these release notes: * EVPay 2.04.05 R01 (7.0.2 and 7.03) * EVPAY 2.08.01 R01 (7.0.3) and higher ### Platform Enhancements Over the years, Verifone has made several security enhancements and updates to the platform across multiple release lines. These enhancements and updates strengthen the overall security framework used in our devices. They fall into the following categories: * [Application and Package Integrity](#application-and-package-integrity) * [Cryptography and Key Protection ](#cryptography-and-key-protection) * [Authentication and Access Controls](#authentication-and-access-control) * [Deprecation of Legacy Components](#deprecation-of-legacy-interfaces) * [Ongoing Platform Hardening](#ongoing-platform-hardening) The complete set of enhancements is available in the included platform Version as part of the application release. This release builds incrementally on the prior releases making this the most current, most fully enhanced release available today. Verifone’s top priority is helping partners and customers move to the most secure platform version and stay current as threats evolve. Verifone strongly recommends that partners and customers operating a device listed in the “Supported Models” section to upgrade to this Application version at a minimum, regardless of current version. Every platform release includes ongoing improvements driven by our security review process. Taken together, these changes represent a meaningfully stronger security posture than earlier versions of the platform, further hardening protections around software installation, cryptographic key handling, and system-level interfaces. The sections below group the key security enhancements by category. If you are running on a version that predates these changes, upgrading to the current release is the most direct way to bring your deployed devices up to the platform's current security baseline. #### Application and Package Integrity Controls that ensure only trusted, verified software can be installed and run on the device. * **Added consistency checks** that strengthen the validation of system components, so only certified components are recognized as part of normal device operation. * **New safeguards with environment variable filtering.** Added blocklist for variables passed to user apps, allowlist for system software to prevent spoofed environment attacks, ensuring applications run only in their intended, verified environment. * **Strengthened verification checks** in the package installation mechanism to ensure only authorized software runs on the device. * **Added path-validation checks** during update-package extraction that reject file and directory references resolving outside the intended installation directory, to prevent package content from being written to unintended locations. #### Cryptography and Key Protection Modernized cryptographic foundations that protect stored keys and secure communications. * **Enforced modern cryptographic standards,** keeping key lengths and cryptographic hash algorithms aligned with current best practices across the platform. Added full support for all AES and ECC key sizes. * **Upgraded cryptographic libraries** to add support for current TLS standards, reinforcing secure communications. * **Restricted downgrade paths** to reinforce that key protection remains consistent with current standards rather than reverting to legacy protection methods. * **Removed legacy PIN encryption methods** and moved to using modern, secure key-handling processes for PIN encryption. #### Authentication and Access Control Tighter requirements around who and what can reach sensitive system-level functions. * **Strengthened minimum authentication requirements** for system-level access. * **Tightened access controls** for diagnostic and system-level interfaces, consistent with the platform's layered security approach. * **Security policy correction.** Removed an unnecessary execute permission, preventing a privilege-escalation path within the device's security-policy enforcement layer. * **Service-dispatch restriction.** Restricted the internal service-dispatch mechanism used by the device's network-control process to a defined set of permitted functions, preventing a privilege-escalation path to invoke internal functions outside their intended scope. #### Deprecation of Legacy Interfaces Streamlining of unnecessary or outdated components as part of ongoing platform modernization. * **Deprecated legacy Engage EMV interface,** in favor of the SDI interface, aligning with current security best practices. * **Removed unused legacy MSR service,** in favor of secure middleware component, strengthening the platform's overall security posture. #### Ongoing Platform Hardening Security is treated as a continuous process, not a one-time milestone. * **Continued hardening of platform APIs and interfaces** as part of an ongoing security modernization effort, meaning each release builds on the protections introduced before it. * **MSR driver rework** delivers additional security hardening improvements to the magnetic stripe reader driver. * **Application online signing support** added, with the option to continue using physical signing cards for organizations that prefer that method. * **Media-handling input sanitization.** Strengthened validation within the media-handling framework as part of ongoing security hardening. * **Network-configuration input isolation.** Added additional safeguards to the network-configuration process to further reduce injection risk. * **Rendering service input validation.** Added validation to the rendering service's handling of externally supplied content requested through the terminal's management interface to prevent any unintended code-execution path. * **System service input isolation.** Added validation that isolates the system service's configuration parameters, to prevent unwanted launch of processes with elevated privileges. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.verifone.com/petroleum-docs/petro-and-c-store/pin-pads/release-notes/platform-release-notes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.