Fixed and Known Issues in 33.xx

The following table lists the fixed issues for 33.xx releases.

Fixed Issues

ISSUE ID	DESCRIPTION
CWP-62576 Fixed in 33.03.138	Resolving Severity Scores and CVE Links for GO Vulnerabilities in OSV Feed When processing CVEs sourced from both the GO and GitHub Security Advisories (GHSA) formats in the Open Source Vulnerability (OSV) feed, incorrect severity scores and CVE links were assigned. This issue is resolved. The fix ensures that the severity scores, CVSS values, and CVE links for GO vulnerabilities are accurate and aligned with the official OSV GO feed.
PCSUP-26234 Fixed in 33.03.138	Storage issues during the Defender shutdown process The Defender shutdown process in versions 32.02 through 32.05 (inclusive) shut down the storage component using a third-party package. This package used a flag to force storage to unmount during the shutdown, which lead to storage corruption in some cases. This issue was resolved in 32.06 by modifying the shutdown process to perform a non-forced unmount. For any Defender instance from the affected versions that has already been shut down, upgrade the defender to a non-affected version (32.06 or later) and then reboot the node to clean up any storage corruption.
CWP-62313 Fixed in 33.02.130	Improved Status Filter for Cloud Security Agent Page The "Status" filter under Prisma UI > Manage > Defenders > Cloud Security Agent was displaying only the statuses present in the table, instead of all possible statuses. This issue has been resolved. The CSA status filter now shows a list of all available statuses: Connected, Disconnected, and Lost. This ensures users can filter the table by any status.
CWP-35710 Fixed in 33.02.130	Removing Namespaces After Resource Deletion In some cases, namespaces remained visible even after all resources within them had been deleted. This led to incorrect vulnerability assessments as the namespaces were not properly removed from the results. This issue is now resolved.
CWP-62296 Fixed in 33.02.130	Consistent Vulnerability Data for Red Hat-Sourced Packages Certain vulnerabilities for Red Hat packages showed a Red Hat severity but CVSS scores from NVD. This mismatch is now resolved. The fix ensures that both the severity and CVSS score now align with Red Hat’s data, eliminating inconsistencies.
CWP-62084 Fixed in 33.01.137	Updating the list of binaries exposed to a vulnerability after rerunning a scan Rerunning a scan didn’t update the binary packages exposed to a vulnerability. This issue is fixed now.
CWP-61947 Fixed in 33.01.137	Boot volume encryption in agentless scanning Fixed an issue with the agentless scanner boot volume default encryption.
CWP-61606 Fixed in 33.01.137	CSV Export Compatibility with Excel The exported CSV file from the Monitor > Vulnerabilities > Images > Deployed page could not be opened in Excel when the Hosts field exceeded the maximum character limit of 32,768 per column. This issue is resolved. The fix ensures that the CSV now lists all the hostnames running the same image. However, if the total length exceeds 32,757 characters, the list is truncated, and the number of truncated hostnames is indicated in the CSV.
CWP-59281 Fixed in 33.01.137	Improved vulnerability reporting for Debian images When scanning Debian images, Prisma Cloud occasionally missed some CVEs related to specific package versions. This issue is fixed. The fix prioritizes CVE matches from the security repository and Prisma Cloud now reports all previously missing CVEs for packages in Debian images.
CWP-58952 Fixed in 33.01.137	Improved vulnerability detection for multiple Python versions In previous versions of Defender, vulnerabilities were only detected and reported for a single Python installation on a host, even if multiple Python versions were installed. This resulted in False Negatives (FN), where vulnerabilities in other Python versions were missed. The issue is fixed. Prisma Cloud will now scan and report vulnerabilities for each installed Python version on a host.
CWP-59654 Fixed in 33.01.137	Support for Amazon Linux CVEs Previously, Prisma Cloud reported several false positive vulnerabilities for Amazon Linux CVEs that were marked as "not affected" by Amazon. Prisma Cloud now fully supports CVEs classified as “not affected” by Amazon, improving the accuracy of vulnerability reporting for Amazon products and resolving the false positive issue. The supported Amazon Linux distributions include Amazon Linux, Amazon Linux 2, and Amazon Linux 2023. Prisma Cloud does not support CVEs labeled as "pending fix" or "no fix planned," as Amazon does not provide the required package version details for precise CVE status reporting.
CWP-61444 Fixed in 33.00.169	Improvements in Amazon Linux Vulnerability Reporting Vulnerability information for many Amazon Linux CVEs lacked consistency across different Intelligence Stream updates, including changes in severity levels and fixed status versions. To address this, several key improvements were made, including enhanced consistency across scans, improved handling of duplicated CVEs, accurate ALAS to CVE conversion, and refined kernel package rules. These changes ensure more reliable and actionable vulnerability information for all Amazon distributions and kernel packages.
CWP-58814 Fixed in 33.00.169	Standardizing Java Versioning for Accurate Vulnerability Mapping Inconsistent version numbering for Java products led to several false positives in Prisma Cloud security scans. To ensure accurate mapping of vulnerabilities to Java versions, all Java product versions will be normalized to the standard 1.x format. For example, in the CVE-2023-21930 entry on the National Vulnerability Database (NVD), OpenJDK 8 will map to Java 1.8.
CWP-58355 Fixed in 33.00.169	Enhanced Detection for Minor Versions in Alpine Packages Alpine’s security database shows vulnerabilities for each Alpine package, including fixed versions and associated CVEs. However, when the CVE does not include a fixed version, the rule misses vulnerabilities in minor versions, leading to incomplete vulnerability coverage. This issue has been fixed. The updated vulnerability rules ensure that minor versions are included, even when no specific fixed version is available.
CWP-61220 Fixed in 33.00.169	CVEs Resolved in Release 33.00 While alerts were generated for CVE-2024-6104 and CVE-2024-29018, Prisma Cloud was not directly vulnerable and remained safe to use. The alerts have been resolved in Prisma Cloud release 33.00.
CWP-58073 Fixed in 33.00.169	Customers could pass invalid data to the v1/alert-profile and collections APIs. To address this issue, the following validations have been added: For v1/alert-profiles APIs: The name parameter must be less than 50 characters. The email address must be valid. The port parameter must not be less than 1. The recipient’s email address must be valid. For Collections: The name parameter must be less than 50 characters. The description parameter must be less than 200 characters.
CWP-59190 Fixed in 33.00.169	Improved Image Scanning If the Defender disconnects while scanning an image that has the same tag, registry, repository, and credentials, it can lead to multiple scan requests of the same image. In addition, a race condition could sometimes prevent the image from being properly removed from the host container registry after scanning. This fix ensures that only one scan is performed per image, even if multiple scan requests are triggered by disconnections. This reduces the load on the Defender. The fix also addresses the race condition. However, not all possible race conditions are addressed: If the same image is scanned in different repositories or registries, race conditions are not addressed by this fix. If the same image is scanned in the same repository and registry but with different tags, the fix does not handle potential race conditions.
CWP-59443 Fixed in 33.00.169	Previously, users experienced intermittent timeouts in a shorter timeframe than the default inactivity period, which was set to 300 minutes under Settings > Enterprise Settings > User Idle Timeout > CX. This issue has now been resolved, and all Prisma Cloud tabs log out only after 300 minutes of inactivity.
CWP-59841 Fixed in 33.00.169	Agentless Scanning - Support for OCI root compartment scans OCI instances deployed in the root compartment were not scanned during Agentless scans. Instances in child compartments were scanned as expected, but root compartment instances were excluded without error. This issue is fixed-all compartments, including the root, are now scanned successfully.
CWP-60298 Fixed in 33.00.169	Compliance IDs 440/441 in Lamba Scans Compliance IDs 440/441 triggered false positives during a serverless Lambda scan for kms permissions. This issue is fixed.
CWP-60356 Fixed in 33.00.169	Improved Clarity in Incident Log Messages In certain cases, the command that triggered an incident was missing from the incident capture flow. This caused the messages in the Incident Explorer to occasionally lack clarity, leading to incomplete logs. The fix ensures that executed commands are now included in audit reports when available. Additionally, it prevents the generation of incomplete reports if the command is missing
CWP-60819 Fixed in 33.00.169	Reduced Registry Scan Duration Prisma Cloud sometimes experienced extended registry scan times due to certain images not being correctly recognized. This led to the registry scan missing cached images, resulting in longer scan durations. The cache miss happened because the image ID hash from the Container Runtime API was missing the sha256 prefix. The issue has now been fixed by using the hash from the registry scan request sent by the Console, when available. This ensures cache hits and enhances scan performance.
CWP-60900 Fixed in 33.00.169	Exporting discovered APIs to OpenAPI CSV files from the Runtime > Monitor > WAAS > API discovery > Export CSV page failed if the API had unsupported methods such as PURGE. This issue is fixed.
CWP-61291 Fixed in 33.00.169	Previously, a "buffer full" error was reported with an HTTP 500 status code, when the same port was reused in a specific order across multiple apps in a single WAAS rule. This issue is fixed now.
CWP-61362 Fixed in 33.00.169	Fixed an issue where compliance alerts for malware (Compliance ID 455) did not appear in daily email reports despite failed resources being detected. This fix ensures accurate reporting for agentless scans.
CWP-61375 Fixed in 33.00.169	Agentless Scanning - Resource Group Creation in Target Azure Account during Hub Scan Mode Fixed an issue where resource groups were created in the target account during Azure agentless Hub scan mode. Now, resource groups are no longer created in the target account when a hub account is defined on it.
CWP-61752 Fixed in 33.00.169	The issue related to interruption in the communication between a defender and the console—​that was introduced by the newly introduced fail-safe mechanism aimed to prevent any impact to customer traffic or downtime—​is resolved. The fix requires you to upgrade the Console and the Defenders to version 33.00.

Known Issues

The following table lists the known issues for 33.00 release.

ISSUE ID	DESCRIPTION
CWP-62780	When deploying a Fargate Defender alongside an Nginx server, the Nginx server was inaccessible through a browser, despite both the Fargate Defender container and the Nginx server container launching successfully. Additionally, no access logs were generated in the CloudWatch log file. Workaround: Customize the Nginx container’s error logging behavior by performing the following steps. #1: Edit the nginx.conf as below. # Make sure that this file is copied from the official Nginx container, and not newly created. = error_log stderr; = #2: Use the above custom nginx.conf and the following Dockerfile to build a new Docker image. = # Use the official Nginx image as the base FROM nginx:latest # Remove existing symlink for error.log if it exists RUN rm -f /var/log/nginx/error.log # Copy custom nginx.conf into the container COPY nginx.conf /etc/nginx/nginx.conf # Start Nginx CMD ["nginx", "-g", "daemon off;"] =
CWP-59515	K8s Defender Crash Loop on RKE2 The K8s defender pods on the RKE2 go into a crash loop if the defender is deployed using the default YAML file options. Workaround: For Kubernetes defenders on RKE2, create the YAML file with the “SELinux Policy” option. This workaround is applicable to RKE2 only.
CWP-62297	Twistlock console unable to list image tags from remote repo If defender and remote repository are in different subnet, the image tag pulling using podman search --list -tags is not supported with the same access token issued by registry.twistlock.com.
CWP-59435	Enabling FIPS with TLS 1.3 does not work for WAAS In-Line Due to a compatibility issue in Go programming language’s package, the HTTP server is unable to operate with both FIPS mode and TLS 1.3 enabled simultaneously. This limitation is preventing WAAS In-Line from supporting the configuration.
CWP-53375	In Inventory > Compute Workloads, for users logged in with a role other than the built-in system admin role, currently only data about cloud provider managed registry images and VM instances can be viewed. In particular, for such roles currently data about the following types of assets is not displayed: Run stage images Private registry images Build stage images On-premises hosts/hosts managed by cloud providers unsupported by Compute
CWP-58896	ACI Cloud Discovery- Incorrect Status Field Mapping and Defend Functionality Gaps With the support for ACI in cloud discovery, here are the two issues: Status: The status field currently utilizes Properties > ProvisioningState, which does not reflect the container status. For more information, refer to Azure Container Instances states. Defend: The Defend functionality does not support Azure Container Instances (ACI). The Defend is enabled across all accounts and services, and when selected, it redirects to Images > Registry Settings.
CWP-58709	Duplicate Admission Rules Six admission rules released in Version 32, Update 2 were found to be duplicates of older existing rules. If you need the functionality provided by these rules, we recommend disabling the old rules and using the new corresponding rules, as the older rules will be removed in an upcoming release. The old rules and their corresponding new rules are as follows: Old rule: Twistlock Labs - CIS - Pod created in host process ID namespace. New rule: Twistlock Labs - PSS - Baseline - Pod with containers that share host process ID (hostPID) namespace Old rule: Twistlock Labs - CIS - Pod created on host IPC namespace. New rule: Twistlock Labs - PSS - Baseline - Pod with containers that share host IPC namespace Old rule: Twistlock Labs - CIS - Pod created on host network. New rule: Twistlock Labs - PSS - Baseline - Pod that allows containers to share the host network namespace Old rule: Twistlock Labs - Pod created with sensitive host file system mount. New rule: Twistlock Labs - PSS - Baseline - Pod created with sensitive host file system mount Old rule: Twistlock Labs - CIS - Privileged pod created. New rule: Twistlock Labs - PSS - Baseline - Pod should not run privileged containers Old rule: Twistlock Labs - CIS - Privilege escalation pod created. New rule: Twistlock Labs - PSS - Restricted - Pod that allows container privilege escalation Even though both the new and old rules are enabled by default, you will not receive duplicate alerts as only the first encountered rule is enforced.
CWP-58350	CVE Exclusions Update The following CVEs that are included in the Intelligence Stream feed are ignored: CVE-2022-29583 - GitHub Advisory Database as it is a disputed vulnerability. CVE-2024-3154 - Arbitrary Systemd Property Injection as Defender does not directly use this package.
CWP-52710	While upgrading consoles from the 30.03 release to a 32.xx release, the error log failed to retrieve "size" specification option value during the migration doesn’t impact the migration process and can be ignored.