32.07 (Build 32.07.123)
The following table outlines the release particulars:
Build
32.07.123
Code name
O’Neal - Update 7, 32.07
Release date
July 22nd, 2024
Type
Maintenance Release
SHA-256
579c449ef5137673dcb2a81da6cdbdf2d1e754c1b5b4018f72821a065136df7d
Review the system requirements to learn about the supported operating systems, hypervisors, runtime, tools, and orchestrators.
Upgrade from Previous Releases
Upgrade Defender Versions
With the v32.xx release, the supported (n, n-1, and n-2) Defender versions are v32.xx, v31.xx, and v30.xx. Defender versions below v30.xx such as v22.12 cannot connect to the current version.
Upcoming Defender Obsolescence
With the upcoming v33.00 release, release v30.xx defenders will be obsolete. To prepare for this upcoming update, plan to upgrade defenders to release v31.xx or later.
Upgrade the Prisma Cloud Console
With the v32.xx release, the supported (n, n-1, and n-2) Console versions are v32.xx, v31.xx, and v30.xx. For example: for the current (n) major release v32.xx, the supported n-1 and n-2 versions are v31.xx and v30.xx respectively.
You can upgrade the Prisma Cloud Console from a major release to the next major release, but not to a major release that follows the next. So, to upgrade from the v30.xx release to the v32.xx release, you will have to first upgrade to v31.xx and then upgrade to the v32.xx release.
Enhancements
A new registry scan status
A new status, Partially Completed, has been added to the scan statuses for registry scans. This status is assigned when at least one image has been successfully scanned in the registry. The Partially Completed status also displays the number of images that have been scanned successfully.
Intelligence Stream Updates
Feature
Description
Severity Mapping Update for Intelligence Stream
The severity values for the Intelligence stream are now mapped into 2 predefined values: “ High” and “Medium”.
Note: The severity values are already normalized to create rules. The current change is only specific to the severity reporting name change.
The following list defines the new vendor severity mapping:
Current Severity: Important
New Severity: High
Vendors: Amazon, Oracle, RedHat, Rocky, Suse, Ubuntu
Current Severity: Moderate
New Severity: Medium
Vendors: Oracle, RedHat, Rocky, Suse, Windows
Current Severity: End-of-life
New Severity: Low, Medium, High, or Critical based on NVD
Vendors: Debian
Note: End-of-life will be set in the vulnerability status.
Note: The previous “unimportant”, “unassigned”, “untriaged”, “negligible” and “not yet assigned” severity mapping behaviour remains unchanged.
All the other unrecognized severity values from the different feeds will be assigned according to the NVD severity.
For more information, see CVSS Scoring.
End of support for Debian 10 (Buster)
Debian 10 (Buster) reached end-of-life on June 30, 2024. Starting from July 2024, the Debian Long Term Support (LTS) team has stopped providing security information for Debian 10.
Consequently, vulnerabilities related to Debian 10 (Buster) were removed from the Prisma Cloud Intelligence Stream.
Impact: Starting from this version, customers using Debian Buster (LTS or ELTS) will no longer see vulnerability data related to this version.
API Changes and New APIs
There are no API changes for this release.
Addressed Issues
WAAS Counters Periodically Stop Incrementing and Need Defender Restart
The issue related to interruption in the communication between a defender and the console—that was introduced by the newly introduced fail-safe mechanism aimed to prevent any impact to customer traffic or downtime—is resolved. The fix requires you to upgrade the Console and the Defenders to version 33.00.
Reporting All Affected Versions for GO Package CVEs
For some GO package CVEs, Prisma Cloud did not completely report all the affected versions, particularly when multiple version ranges were involved, resulting in occasional false negatives.
This issue is fixed. Prisma Cloud now reports all the affected versions for GO package CVEs.
Improved CVE Matching for JAR Files with Group IDs
When a JAR file with a group ID is used as a dependency in other JAR files within the same image, Prisma Cloud might fail to properly identify or match CVEs to those JAR files.
This issue is resolved. Prisma Cloud now correctly handles group IDs in both the Defender and the Console, improving the ability to identify CVEs accurately for such JAR files.
Fixed False Positives Caused by RPM and Third-Party Package Name Discrepancies
Addressed the issue of false positives during vulnerability assessment due discrepancies between RPM package names, , and third-party package names where the same CVE may be listed under different names for example, urllib3 for Python versus python3-urllib3 for RPM. This inconsistency led to potential false positives or missed vulnerabilities. In order to validate if the third-party package should be reported, Prisma Cloud now also assesses the origin package name.
Improved parsing of Jenkins Security Advisory for Fix Versions
Corrected parsing of Jenkins security information in affected versions and fix versions due to a scheme change. For example, the Jenkins Security Advisory 2021-10-06 did not produce fixed versions, showing all versions as vulnerable despite CVE-2014-3577 being fixed up to and including version 2.314.
Fixed incorrect Image Name Retrieval for Non-RPM Containers in Openshift Clusters
Addressed an issue with Openshift cluster where incorrect image names were fetched for non RPM container images due to the cluster having a generic name for example, openshift-release-dev/ocp-v4.0-art-dev. To resolve this, the mapping extracts the release and version from image labels and adjusts the name by combining registry, origin name, release, and version to be the image name. For example <registry>/<image_name>:<version>-<release>.
Support for FIPS-enabled OpenSSL packages
Previously, Prisma Cloud skipped scanning Federal Information Processing Standards (FIPS)-enabled OpenSSL packages to avoid overriding older releases, and instead matched against non-FIPS versions. This led to inaccurate vulnerability reporting.
This issue has been fixed. Prisma Cloud now fully supports scanning FIPS-enabled OpenSSL versions, ensuring correct vulnerability detection and eliminating false positives.
Add collections filtering behavior
Previously, image scan filtering by collection restricted the collections listed in the Collections column to the collection selected in the filter. This issue is fixed now. Now, for each image, all related collections of the filtered images are displayed, even when a specific collection filter is applied.
Errors added to Console log when scanning images by Defender
Previously, errors encountered during image scans by Defender were not added to the console log.
This issue has been fixed. Now, when Defender scans images, error messages are printed to the console log along with the image ID and the name of the Defender.
[Container dump API] Allow to include labels for each container
A new optional query parameter includeLabels is added to the Download Container Scan Results API. This change will add all the labels corresponding to each container in the API response.
Ruby Pessimistic version constraint rules are not merged correctly with other rule ranges causing FPs
Previously, Prisma Cloud did not handle cases involving unaffected and patched Ruby version ranges correctly. Additionally, cases, where patched Ruby version ranges, were included within unaffected Ruby versions using the pessimistic version constraint (~>), those cases were also not handled correctly. This issue has been resolved.
Backward Compatibility for New Features
There is no backward compatibility for new features in this release.
Changes in Existing Behavior
Enhancement to Photon OS and Amazon Linux OS Feeds
Prisma Cloud now parses Photon OS and Amazon Linux OS feeds using CVE IDs as the primary vulnerability identifier instead of advisory IDs.
This change enhances Prisma Cloud’s ability to correlate third-party data, and use vendor-provided information, including backports, severity assessments, and vulnerability scores.
End of Support Notifications
There are no End of Support notifications for this release.
Deprecation Notices
There are no other deprecation notices for this release.
Last updated
Was this helpful?