32.03 (Build 32.03.125)

The following table outlines the release particulars:

Build	32.03.125
Code name	O’Neal - Update 3, 32.03
Release date	February 26th, 2024
Type	Maintenance Release
SHA-256	a0eaa3d27aa3275de75fc720417a2de7f730bbd9a3ac60cc3db4af87415817e0

Review the system requirements to learn about the supported operating systems, hypervisors, runtime, tools, and orchestrators.

Upgrade from Previous Releases

Upgrade Defender Versions 22.12 and Earlier

With the v32.00 release, Defender versions supported (n, n-1, and n-2) are v32.00, v31.00, and v30.00.

To prepare for this update, you must upgrade your Defenders from version v22.12 (Lagrange) or earlier to a later version. Failure to upgrade Defenders will result in disconnection of any Defender version below v30.00 such as v22.12.

Upcoming Defender Obsolescence

With the upcoming v33.00 release, release v30.xx defenders will be obsolete. To prepare for this coming update, plan for upgrading to release v31.xx or later at the earliest.

Upgrade the Prisma Cloud Console

With the v32.00 release, the supported Console versions (n, n-1, and n-2) are v32.00, v31.00, and v30.00.

You can upgrade the Prisma Cloud console directly from any version for n-1 to n. With v30.00 as n-1 and v31.00 as n, you can for example go directly from v30.01.153 to v31.00.129.

You have to upgrade any version of v22.00 to v30.00 before upgrading to v31.00. For example, you can upgrade from v22.12.693 to v30.02.123 and then upgrade to v32.00.159.

Enhancements

FEATURE	DESCRIPTION
Support Amazon Linux 2023	Prisma Cloud now supports Amazon Linux 2023 OS scans and security feed integration for Amazon Linux 2023.
Enhanced CSV Organization	Segregating vulnerability and compliance findings based on Download Context.
Enhanced Compliance Report	Added a new Result column to the compliance report CSV file. To get the report, go to Monitor > Compliance > Compliance Explorer and select Containers, Images, or Hosts. The new column shows either pass or fail for each resource and the corresponding compliance check ID.
Detect Go Stdlib Vulnerabilities at the Package Level	In O’Neal Update 3, Prisma Cloud has enhanced its capability to detect vulnerabilities in Go libraries. Previously, a broad approach was used for Go stdlib libraries, categorizing CVEs as "Go" vulnerabilities rather than associating them with specific vulnerable standard libraries. This update offers a more precise classification, allowing for the identification of specific vulnerable symbols within libraries. Moreover, the latest agents can now detect both stdlib with symbols they utilize and the installed Go runtime. This comprehensive approach enables Prisma Cloud to conduct more accurate vulnerability assessments, leading to a significant reduction in false positives. If you have utilized the Go detection capabilities previously, you are likely to experience a noticeable reduction in the number of reported vulnerabilities due to this improvement.

API Changes and New APIs

Split Vulnerability and Compliance CSV	The following APIs include a new parameter, issueType: Download Host Scan Results Download Image Scan Results Download Registry Scan Results Download CI Image Scan Results Download VM Image Scan Results Download Serverless Function Scan Results The issueType parameter can be set to vulnerabilities or compliance for downloading vulnerability or compliance issues respectively. If either value is not provided, both vulnerability and compliance issues are downloaded.
"Type" field is internal only - not returned in 'vulnerabilities' API json (scan results)	The following APIs include a new parameter, packageType: Get Container Scan Results Get Host Scan Results Resolve Hosts Get Image Scan Results Resolve Images Get All CI Image Scan Results Add CLI Scan Result Get Serverless Function Scan Results Resolve Functions Get VM Image Scan Results Resolve Code Repos Add Sandbox Scan Result Get Registry Scan Results The ‘packageType’ field is added to the vulnerabilities schema responses.
New incident policies based on traffic observation	This update adds two new policies that alert you to traffic that includes: Sensitive data sent through an API endpoint that is exposed to the internet without authentication. Sensitive data sent through an API endpoint that is exposed to the internet without encryption.

Addressed Issues

WAAS	Improved accuracy of information leakage detection that resolves some false positives.
Tools	Fixed twistcli tarball scan failing on hardlinks to symlinks without target files.
CVE Type Mapping Mismatch	The following changes are done to the CVE package type names: binary changed to Application Product changed to Application package changed to OS javascript changed to nodejs
Vulnerability Management	Fixed a filtering issue that excluded Ruby’s app and OS vulnerabilities during evaluation.
Vulnerability Management	Fixed an issue that resulted in duplicate CVE records because of inconsistencies in the CPE list that is included in the RHEL feeds.
Registry Scanning	Fixed an issue that caused previous scan results of a failed registry scan to be removed.
Agentless Scanning	The agentless scanner boot volume now enforces encryption by default.
*Vulnerability Scan	Fixed an issue that caused duplicate jar entries with mismatched versions in vulnerability scan reports.