32.05 (Build 32.05.124)

The following table outlines the release particulars:

Build	32.05.124
Code name	O’Neal - Update 5, 32.05
Release date	May 06th, 2024
Type	Maintenance Release
SHA-256	cff79c990ecdfc255d52f03a77ea1fc169bd21b89d23978677cc5d5b657b9526

Review the system requirements to learn about the supported operating systems, hypervisors, runtime, tools, and orchestrators.

Upgrade from Previous Releases

Upgrade Defender Versions

With the v32.xx release, the supported (n, n-1, and n-2) Defender versions are v32.xx, v31.xx, and v30.xx. Defender versions below v30.xx such as v22.12 cannot connect to the current version.

Upcoming Defender Obsolescence

With the upcoming v33.00 release, release v30.xx defenders will be obsolete. To prepare for this upcoming update, plan to upgrade defenders to release v31.xx or later.

Upgrade the Prisma Cloud Console

With the v32.xx release, the supported (n, n-1, and n-2) Console versions are v32.xx, v31.xx, and v30.xx. For example: for the current (n) major release v32.xx, the supported n-1 and n-2 versions are v31.xx and v30.xx respectively.

You can upgrade the Prisma Cloud Console from a major release to the next major release, but not to a major release that follows the next. So, to upgrade from the v30.xx release to the v32.xx release, you will have to first upgrade to v31.xx and then upgrade to the v32.xx release.

Enhancements

FEATURE	DESCRIPTION
Enhanced Vulnerability Assessment	To enhance the accuracy of vulnerability assessments, Prisma Cloud has incorporated support for the 'Running On/With' configuration as outlined by NVD. This configuration, which integrates nodes based on both vulnerable and non-vulnerable criteria, requires specific conditions to be met, such as relevant packages or operating systems, for a vulnerability to be applicable. This enhancement allows Prisma Cloud to consider 'Running On/With' configurations that were not previously assessed. However, it is important to note that the impact of this enhancement is contingent on whether the CVE is assessed through NVD, as vulnerability information from the vendor feed is prioritized.
Serverless Defender support for Java 17 and 21	Added support for deploying Serverless Defender on Java 17 and Java 21 runtimes.
Cloud Account Management	Introduced the Account Origin filter on the Cloud Accounts page in Runtime Security. This feature includes three statuses: Compute: Cloud accounts created in Runtime Security only (and not in the Prisma Cloud console). Prisma - Manually imported: Cloud accounts that were manually imported from Prisma Cloud console to Runtime Security prior to the Lagrange release (end of 2022). Prisma - Auto imported: Cloud accounts that originated from Prisma Cloud console and seamlessly imported into Runtime Security.
New Console Environment Variable for System Load Management	A new Console environment variable, REFRESH_INTERVAL_SECONDS, has been added to prevent system overload issues when using the TAS applications with Defender. Previously, Defender checked the state of TAS applications and containers every 10 seconds through an API call to the BBS server. However, frequent changes or restarts in applications within this duration could lead to system overload as Defender scanned all the apps that were impacted by the changes. By setting a higher value for REFRESH_INTERVAL_SECONDS, users can now reduce system load by decreasing the scanning frequency. For example, if REFRESH_INTERVAL_SECONDS is set to 600 seconds, Defender checks for changes every 600 seconds, leading to a decrease in system load. Restart Defender for the REFRESH_INTERVAL_SECONDS environment variable to take effect.
OS-specific Evaluation for Go Packages	Prisma Cloud now evaluates operating system (OS) data for vulnerabilities detected in Go packages. This enhancement ensures that vulnerabilities are reported only if they meet the OS-specific criteria. For example, if vulnerabilities are detected in Go packages that are specific to Windows, they are reported only for Windows-based systems. They are not flagged for UNIX-based systems. To view a detailed list of identified vulnerabilities, go to Monitor > Vulnerabilities > Vulnerability Explorer.
Support for Google Registry Scanning	When onboarding GCP cloud accounts, Prisma Cloud now supports scanning of Google Container Registry (GCR) and Google Artifact Registry (GAR).
Support for Blocking Kubernetes cri-o Containers	For Kubernetes versions employing latest versions of cri-o runtime, crun replaces runc for launching containers. To manage user-defined vulnerability/compliance blocking rules, however, Prisma Cloud uses, when such rules are present, a binary written in the Go language to proxy the crun runtime. This proxy blocks containers whenever vulnerabilities or compliance issues, as per user-defined rules, are detected. Prisma Cloud uses the original crun runtime for all other functionalities. If you want to run containers with a minimal number of processes, you can’t set a low PIDs limit, because the Go binary generates multiple threads. The original crun runtime does not have this limitation, as it is written in C.

Addressed Issues

Fixed Containerized Scan Failure	Resolved issue causing containerized scans to fail due to long scan data, particularly when encountering large Java dependency lists. You can now conduct scans without encountering this issue.
Improved Handling of Rejected and Disputed CVEs	With the transition to the CVE 5.0 dataset, NVD has updated the format of rejected CVE descriptions. Prisma Cloud now seamlessly identifies 'Rejected' and 'Disputed' statuses of CVEs. In NVD the status is now labeled as 'Rejected reason', while CVEs tagged as 'Disputed' are identified using cve.org data source, ensuring accurate vulnerability assessment.
Exported CSV does not include sam data across all asset types	Fix an issue where risk factor field was missed on Function and Host CSV results.
Parsing issues in vulnerable package versions	The fix resolves the following issues related to detection of vulnerable package versions: Correct parsing of vulnerable package versions. Parsing of version ranges with different prefixes. Handling of conditions for multiple versions to ensure they are added to the Intelligence feed. This resolves both false negative and false positive alerts.
Defender fails to re-scan TAS applications after changes	Previously, if modifications were done to a TAS application (such as renaming it), Defender would fail to re-scan the application and update the results in the Console. This issue has been resolved. Defender now re-scans the TAS applications whenever changes are made to them.
Alpine Linux zlib not affected by CVE-2023-6992	CVE-2023-6992 impacts the Cloudflare version of the zlib library. However, the zlib library included in Alpine Linux is not affected by this vulnerability. A formal request has been made to Alpine Linux to classify this CVE as a non-vulnerability for their zlib version. The necessary patch has been merged, and we anticipate its inclusion in the Alpine Linux Security Database soon.

Backward Compatibility for New Features

There is no backward compatibility for new features in this release.

Change in Behavior

There are no changes in behavior for this release.

End of Support Notifications

There are no End of Support notifications for this release.

Deprecation Notices

Deprecated "Send Debug Logs to Support" Button

The "Send Debug Logs to Support" button in Manage > Logs > Console page is deprecated. You cannot send debug logs directly to Prisma Cloud Support from the Console Debug Logs page.

To obtain the console debug logs for sending it to the support team, click the Download Logs icon in the Console Debug Logs page. The log file is downloaded to your local computer.