OS Bundle Package No Longer Overwrites App Version
34.04.160
| Fixed the scanner to prevent OS bundle packages from overwriting the application version during `correlateOSPackages`. This resolves incorrect vulnerability matches that occurred when OS package metadata incorrectly replaced application version information. | |SQLite Read-Only Filesystem No Longer Causes Extraction Failure
34.04.160
| Fixed an issue where a read-only SQLite filesystem caused OS package extraction to fail during image scanning. The scanner now handles read-only filesystem conditions correctly. | |Disabled AWS Regions me-south-1 and me-central-1 to Prevent STS Timeouts
34.04.160
| Disabled the `me-south-1` and `me-central-1` AWS regions to prevent STS authentication timeouts that affected serverless scanning operations. | |Image Scanner Cleans Up Extracted JAR Files
34.04.160
| Fixed the image scanner to delete extracted JAR files immediately after inspection and clean up stale JAR directories on startup. This prevents disk space exhaustion caused by accumulated temporary files. | |Defender Connectivity Issue Resolved
34.04.156
|Resolved a regression in Quinn update 34.04.145 that makes the Defender set iptables/nftables entries in your environment, even when there is no policy such as Cloud Native Network Security (CNNS) or DNS monitoring requesting it.
This bug affects all 34.04 Defenders. If the Defender is deployed on Tanzu Application Service (TAS), this may lead to severe connectivity issues.
The referenced hotfix addresses this issue and ensures that iptables/nftables rules are set only when it is explicitly reflected in the policy.
| |Resolved Issues
34.04.156
|Additional Fixes & Improvements:
Failed to initialize CRI client: runtime version cannot be determined.
CWP-64752
34.04.156
|Fixed false-positive vulnerability matches for third-party packages
Fixed scanner to stop incorrectly deriving correlated OS package versions for all third-party package types, preventing false-positive vulnerability matches.
| |CWP-64741
34.04.156
|Fixed AVA scan result corruption
Fixed an issue where trailing output after an AVA (sub) process scan could corrupt scan results.
| |CWP-64729
34.04.156
|CNNF rules applied only when enabled
Fixed Cloud Native Network Firewall to only apply rules when the feature is explicitly enabled, preventing unintended network enforcement.
| |CWP-64712
34.04.156
|Fixed container Defender status command
Fixed the container Defender status command output.
| |CWP-64122
34.04.156
|Improved gzip file detection
Fixed tarball/gzip detection to use magic bytes rather than relying solely on file extension, resolving scan failures for misnamed archives.
| |CWP-64647
34.04.156
|Fixed Windows vulnerability assessments
Fixed incorrect FixedBuild mapping across Windows product IDs in the intelligence builder, resolving inaccurate Windows vulnerability assessments.
| |CWP-64675
34.04.156
|Execute yum as root for RPM database access
Fixed image augmentation to execute yum commands as root when accessing RPM databases via SQLite, resolving scan failures on certain container images.
| |CWP-64702
34.04.156
|Fixed crash in compressed layer verification
Fixed a potential crash caused by an array index out of bounds when verifying compressed layer timestamps during image scanning.
| |CWP-64581
34.04.145
|Resolved rare kernel panic in runtime monitoring
Fixed a race condition in fsmon that could lead to a kernel panic.
| |CWP-64543
34.04.145
|Fixed WAAS rule forcing defender memory to 4GB
WAAS rule no longer forces defender max memory to 4GB when enabled on a cluster.
| |CWP-64542
34.04.145
|Fixed defender memory settings preservation
Defender memory settings are now preserved correctly and no longer decrease unexpectedly.
| |CWP-64538
34.04.145
|Fixed SSH host activity detection on Debian 13
SSH host activity is now properly detected on Debian 13 systems.
| |CWP-64513
34.04.145
|Improved version detection accuracy for vulnerability assessment
Defender and twistcli now correctly use OS package version when an app is correlated but its version is missing.
| |CWP-64494
34.04.145
|Reduced false positive CVEs from RPM Epoch detection
Fixed possible false positive CVE-2023-47038 due to RPM Epoch detection issues.
| |CWP-64486
34.04.145
|Fixed container data display in image tab for agentless scans
Container data now displays correctly in the image tab when using agentless scanning.
| |CWP-64467
34.04.145
|Resolved yum hang during agentless scanning
Fixed an issue where the yum command would get stuck during agentless scanning.
| |CWP-64464
34.04.145
|Fixed OCI agentless connectivity in Ashburn region
Resolved agentless connectivity issues for OCI in the Ashburn region.
| |CWP-64458
34.04.145
|Improved busybox version detection in agentless scans
Agentless scanning now correctly detects the full busybox version on hosts.
| |CWP-64454
34.04.145
|Multiple defender stability improvements
Backlog bug fixes for defender stability in Quinn Update 4.
| |CWP-64425
34.04.145
|Fixed app-embedded defender exit on DNS resolution failures
App-embedded defender no longer exits when handleGetAddrInfoEvent fails.
| |CWP-64402
34.04.145
|Fixed 502 bad gateway error in Runtime Security Module
Resolved a Runtime Security connectivity issue.
| |CWP-64398
34.04.145
|Fixed image cleanup skipping images with empty hosts
Image cleanup logic no longer skips images when the hosts field is empty.
| |CWP-64382
34.04.145
|Fixed RHEL 10 defender false iptables error logging
Host defender using nftables on RHEL 10 no longer logs errors about missing iptables.
| |CWP-64380
34.04.145
|Fixed Cloud Run functions appearing in Radar when feature flag is off
Functions created with gcloud run are no longer listed in Radar view when the feature flag is disabled.
| |CWP-64367
34.04.145
|Fixed ServiceNow alert integration reliability
Resolved issues with alerts failing to send to ServiceNow.
| |CWP-64359
34.04.145
|Fixed CNNS container summary count mismatch
CNNS for containers now correctly sums up to match its detail counts.
| |CWP-64358
34.04.145
|Fixed incident audit CSV serial number column
The twistlock\_incidents\_audit CSV file serial number column now increments correctly instead of showing constant #0.
| |CWP-64319
34.04.145
|Fixed registry scan handling of long image tags
Registry scan image cleanup no longer fails when tag exceeds 128-character limit.
| |CWP-64237
34.04.145
|Fixed consistent WAAS protection for Istio traffic
Istio traffic is now consistently protected by defender when using WAAS.
| |CWP-64233
34.04.145
|Fixed registry scanner error message formatting
Registry scanner log now shows proper image pull error messages instead of %!s(MISSING).
| |CWP-64167
34.04.145
|Resolved log flooding from missing container images
Fixed "Failed to find image for container" messages flooding the log.
| |CWP-64117
34.04.145
|Fixed ECS EXTERNAL launch type handling
Cloud Discovery now correctly handles ECS EXTERNAL launch type.
| |CWP-64116
34.04.145
|Fixed auto-defend rules custom role filtering
Host and serverless auto-defend rules are now properly filtered by custom role.
| |CWP-64068
34.04.145
|Fixed agentless scan status persistence after refresh
Agentless last scan field no longer disappears on page refresh.
| |CWP-64402
34.04.145
|Fixed 502 bad gateway error in Runtime Security Module
Resolved a Runtime Security connectivity issue.
| |CWP-64398
34.04.145
|Image cleanup logic skips images when hosts field is empty
Fixed an issue where images that have been deleted from their namespaces are still being shown in the console.
| |CWP-64117
34.04.145
|Cloud Discovery limitation resolved
ECS task definition containers with launchType: External that are listed in the Inventory are not present in the Prisma Cloud Console ( Runtime Security > Radar). This issue is now fixed.
CWP-63717
34.04.145
|Filepaths of secrets found by scanners other than agentless contain prefix of scan directory
Resolved an issue with the Vulnerability scan report for registry images showing vulnerabilities that are tagged to an image path which does not actually exist on the image.
| |CWP-64258
34.04.145
|Cloud Radar resource reporting
Fixed an issue with the inaccurate reporting for Defended resources.
| |CWP-64116
34.04.145
|Console - host and serverless auto-defend rules are not filtered by custom role
Resolved an issue with a custom role user not being able to access certain specifications when working with Defender Auto-Deploy rules.
| |CWP-64265
34.04.145
|Macro fields not populated
Fixed an issue with some macro fields not being populated, when a Compliance trigger is set up to forward alerts via Webhook to Service Now.
| |CWP-64459
34.04.145
|NF table support
Following the addition of NF tables support in WAAS, NF tables support is also now available for Defender (CNNF and Runtime Policy).
Note: Open issues relating to the Compliance scan flow, will be addressed in a subsequent release.
| |CWP-64543
34.04.145
|Defender Memory Settings
This fix prevents memory decrease if it is already set.
| |CWP-63255
34.04.145
|Unused Defender packages
Removed multiple unused packages to reduce exposure to CVEs.
| |CWP-64867
34.03.138
|RPM database patch
Added a sqlite3 patch for RPM database (rpmdb) to address package metadata extraction issues in RPM-based images.
| |PCSUP-29054
34.03.138
|Standardized Non-Privileged User ID for Defender CLI
To enhance security across all supported operating systems, the Defender component will now use the standardized, non-privileged User ID (1100) when executing Command Line Interface (CLI) commands.
| |CWP-63569
34.03.138
|Account-level reporting of scan date and time
The scan start and end date and time were earlier reported at the region level and weren’t precise in some situations. This fix ensures accurate reporting of scan start and end date and time at the individual account level.
| |CWP-63632
34.03.138
|Release name for Windows Server 2025 doesn’t resolve correctly
This issue is fixed now. The release name for Windows Server 2025 displays correctly.
| |CWP-64185
34.03.138
|Improved defender stability with Read-only 'runc' paths
Previously, in crio environments, if the paths to runc were located in read-only directories, the defender would delegate the calls to the first runtime it found, increasing the risk of node instability.
This issue has now been resolved, and defender will use the default runtime. To properly deploy the newer version containing this fix, follow these steps:
CWP-64196
34.03.138
|App-embedded Defender crashes on thread termination
The App-embedded defender crashes if the application it is protecting, or a thread of the application, terminates while it is connecting to the app-embedded defender.
| |CWP-61530
34.02.133
|False positives for Oracle images and hosts
The issue with CVE matching for Oracle images and hosts, which caused false positives due to missing Oracle module information, is fixed now.
| |CWP-63043
34.02.133
|False positives for OpenShift images
False positives were reported for OpenShift images due to incorrect parsing of the release label.
This issue is fixed now.
| |CWP-63194
34.02.133
|False positives due to incorrect Red Hat version comparison
Added support for the epoch prefix in Red Hat images. Previously, the epoch was omitted during image scanning, causing version comparisons to ignore it and resulting in false positives. This fix ensures the epoch value is included, allowing accurate version comparisons and preventing incorrect vulnerability matches.
| |CWP-63341
34.02.133
|Defender periodic scans are not disabled when the scan interval is set to 0
Even when the scan interval for images, containers and hosts is set to 0 on the Manage > System > Scan page in the UI, the defender continues to execute periodic scans every 24 hours.
This issue is fixed now.
| |CWP-63479
34.02.133
|Incorrect value in the CaaS containers column
The value in the CaaS containers column in the Registry images table on the Monitor > Vulnerabilities > Image > Registries page was not updated if the Fargate task was no longer available in Prisma Cloud.
This issue is fixed now.
| |CWP-63695
34.02.133
|Serverless scanning of Python packages in the requirements.txt file
Previously, dependencies in the requirements.txt file were not considered during vulnerability and compliance scans of Azure serverless functions and GCP Cloud Run functions for Python. Now, packages specified in requirements.txt are also included in the scan.
Note that for packages in the file to be taken into consideration, specific package versions need to be specified using "==". For example: docopt == 0.6.1
| |CWP-63711
34.02.133
|URLs for RHEL repos
The issue with CVE matching that caused false positives when relative URLs for Red Hat repositories are used is fixed now.
| |CWP-63808
34.02.133
|Gateway timeout while loading feeds
Feed changed notifications to Defenders are now batched and spread to prevent 504 Gateway Timeout errors from concurrent downloads. Defenders also use Exponential Backoff with Jitter for retries.
| |CWP-63880
34.02.133
|Base image history tagging
Scanning over 50 digests under one rule caused older base image digests to be deleted, removing base image links. The Base Image tag incorrectly remained under the Layers tab for these images. This has been fixed: the Base Image tag is now correctly removed from the Layers tab for images whose original base images were overridden.
| |CWP-63887
34.02.133
|False positives for Amazon ALAS CVE advisories
False positives were generated because of the change in the URL for the Amazon ALAS CVE advisory file. The underlying cause for these false positives is fixed now.
| |CWP-63924
34.02.133
|Node crashes on OpenShift 4.18 clusters
Node crashes may happen on OpenShift 4.18 clusters in case the defender is configured with a block policy.
This happens because OpenShift 4.18 has changed the default runtime implementation from runc to crun, and the defender didn’t handle that change correctly.
The issue is fixed now.
| |CWP-63935
34.02.133
|JWT tokens with Japanese characters fail to authenticate
Prisma Cloud roles with names that included Japanese characters caused an error.
This issue has been fixed.
| |CWP-63359
34.01.126
|#IngressNightmare vulnerabilities
This issue is fixed now.
An enhanced mechanism for identification of packages helps in improved detection of vulnerabilities, such as the #ingressnightmare vulnerability issue.
This enhancement allows for earlier detection and remediation, proactively mitigating potential exploits.
| |CWP-63421
34.01.126
|The "defended" status for ECS task definitions inocorrectly set to false
ECS task definition entities discovered as part of cloud discovery have a "defended" status. This "defended" status field is set to true if a Fargate defender is detected as installed in one of the containers in the task definition. This "defended" status field was incorrectly set to false even when a Fargate defender was installed in one of the containers.
This issue is fixed now.
| |CWP-62961
Fixed in 34.00.137
|Namespace associations for an image are not refreshed
When an image that is associated with multiple Kubernetes namespaces is removed from one of the namespaces, the namespace associations for the image are not refreshed and the image continues to list the namespace from which it was removed.
This issue is fixed for on-premise deployments now.
To enable this fix, you need to:
By default, the flag CLEAN\_STALE\_NAMESPACES is set to false. When you enable this flag and restart the console, namespaces associated with images are refreshed every 12 hours.
| |CWP-59903
Fixed in 34.00.137
|Cleanup of system resources after registry scanning
A new scanner tag is generated when an image is pulled for scanning. In certain cases, this tag was not properly removed after the scan completed.
This issue is fixed now. Improvements to the registry scan mechanism ensure a proper cleanup of system resources after scanning.
| |CWP-60416
Fixed in 34.00.137
|Incorrect parsing of Ruby advisories that use RC versions
Incorrect parsing of Ruby advisories that use RC versions (such as '3.0.0-rc.1') caused false positive CVE reporting.
This issue is fixed now.
| |CWP-61862
Fixed in 34.00.137
|An incorrect fix date is reported for CVEs that did not provide a fix date initially
An incorrect fix date is reported for CVEs that did not provide a fix date initially and were then reopened and fixed (again) with a fix date that is later than the date when the issue was first reported as fixed. Prisma Cloud reported the date when the issue was first reported as fixed and did not update the fix date after the issue was reopened and fixed with a different date.
This issue is fixed now.
| |CWP-62128
Fixed in 34.00.137
|Changes in the Ubuntu feed caused false positives in some situations
Changes in the Ubuntu feed format added an asterisk in the condition for some CVE entries. This was not parsed correctly and led to false positives.
This issue is fixed now.
| |CWP-62193
Fixed in 34.00.137
|Incorrect fixed version reported for some CVEs reported in NVD
An issue with the parsing of NVD data led to an incorrect fixed version being reported in some cases.
This issue is fixed now.
| |CWP-62290
Fixed in 34.00.137
|Fixed Debian issues that have a CVE with the "nodsa\_reason" property set to "ignored" are reported as a vulnerability
Debian CVEs that have an Urgency of "unimportant" or a "nodsa\_reason" setting of "ignored" in the Debian feed were not reported as vulnerabilities when detected by Prisma Cloud Compute.
This issue is fixed now. Now, such CVEs will be reported as vulnerabilities with the status 'will not fix' by Prisma Cloud Compute.
| |CWP-62394
Fixed in 34.00.137
|In a few situations serverless credits were consumed even after disabling the serverless functionality
In setups/tenants that had a particular (core-serverless-scan-concurrent-flow-enabled) setting enabled, serverless scan results were not deleted. This caused some serverless credits to be consumed even after the serverless feature was disabled in the tenant.
This issue is fixed now.
| |CWP-62552
Fixed in 34.00.137
|Defender is unable to identify the OpenShift installation on the OpenShift nodes
The OpenShift version is not available in the RELEASE\_VERSION environment variable in the running 'openshift-tuned' process due to a change in OpenShift. It has now been replaced by a new process called cluster-node-tuning-operator that receives 'openshift-tuned' via command line args. Defenders were unable to detect the OpenShift installation due to this change.
This issue is fixed now.
| |CWP-62562
Fixed in 34.00.137
|Fixed RHEL issues are incorrectly flagged as unresolved due to an issue in mapping CPEs to RHEL repositories
After Redhat switched to the new VEX format for reporting CVEs and fixes, some fixed RHEL issues were incorrectly flagged as unresolved due to an issue in mapping CPEs to RHEL repositories.
This issue is fixed now.
| |CWP-62570
Fixed in 34.00.137
|Base images when scanned separately displayed vulnerabilities that were not present
The scan results for some base images that were scanned separately incorrectly displayed vulnerabilities–even though no vulnerabilities were present in those base images. Whereas, images using those base images reported the vulnerabilities correctly and did not display any vulnerabilities for the underlying base images.
This issue is fixed now.
| |CWP-62575
Fixed in 34.00.137
|False positives observed for vulnerabilities reported in the RedHat VEX format without specific distro-release information
Vulnerabilities reported in the RedHat VEX format without specific distro-release information generated false positives.
This issue is fixed now.
| |CWP-62590
Fixed in 34.00.137
|Prisma Cloud reported incorrect fix dates for RedHat vulnerabilities
This issue occurred for vulnerabilities reported as fixed through RedHat feeds in the VEX format. This issue is fixed now.
| |CWP-62609
Fixed in 34.00.137
|Including packages of a Go application that are part of the main module in the scan results
Previously, Prisma Cloud scan results did not include Go packages that were part of the main module, resulting in the omission of these packages and their associated vulnerabilities in the console.
This issue has now been resolved.
| |CWP-62668
Fixed in 34.00.137
|Compliance check 598 always fails for Kubernetes containers running Redis if the container was created without using –requirepass parameter
Compliance check 598 fails and shows the error “App uses weak or default password” for Kubernetes containers running redis even though the container uses a strong password. This issue occurs if the container was created without using –requirepass parameter.
This issue is fixed now.
| |CWP-62883
Fixed in 34.00.137
|The 'fix status' column in the vulnerability report is blank for a few CVEs
The 'fix status' column in the vulnerability report is blank for a few CVEs due to missing information in the NVD vulnerability feed.
This issue is fixed now. The required information is now gathered using a separate NVD function.
| |CWP-62884
Fixed in 34.00.137
|Stale unpaired cloud security agents (CSAs) are not deleted
This issue is fixed now.
| |CWP-62994
Fixed in 34.00.137
|Container protected by an App embedded defender with File System monitoring enabled crashes when an SSH connection is made to it
Container protected by an App embedded defender with File System monitoring enabled crashes when an SSH connection is made to it.
This issue is fixed now.
| |CWP-63032
Fixed in 34.00.137
|Support Jenkins LTS CVEs detection
Prisma Cloud now extracts software edition information from CVEs and utilizes it for scanning. This enables Prisma Cloud scanners to differentiate software editions, such as Jenkins LTS releases from regular Jenkins releases, and accurately identify vulnerabilities.
| |CWP-63033
Fixed in 34.00.137
|Improved Vulnerability Reporting for Mirrored RHEL Repositories
Repository identifiers often change when repositories are mirrored from Red Hat’s Content Delivery Network (CDN) to alternative cloud environments, like AWS. This may result in inaccurate vulnerability reporting.
The issue has now been resolved by extracting the relative URLs of repositories from the image and comparing them with the corresponding relative URLs provided in the repository-to-CPE mapping file for CVE matching.
| |CWP-63110
Fixed in 34.00.137
|Incorrect data is returned when Prisma Cloud roles that have read only access to Windows hosts try to access and retrieve data from those Windows hosts
Incorrect data is returned when Prisma Cloud roles that have read only access to Windows hosts try to access and retrieve cloud metadata from those Windows hosts.
This issue is fixed now.
| ## Known Issues The following table lists the known issues for the 34.00 release. | **ISSUE ID** | **DESCRIPTION** | | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | |CWP-63632
34.01.126
|Host details display incorrect Windows version
Windows Server 2025 is incorrectly reported as Windows Server 2022 on the Host details panel.
| | **--** |Google Cloud Run Functions (Gen2) May Not Be Scanned with Selective Registry Scanning
Google offers serverless functions in two versions: Cloud Functions ("Gen1") and Cloud Run Functions ("Gen2"). Prisma Cloud fully supports vulnerability scanning for Gen1 functions.
For Gen2, when code is uploaded to Google Cloud Run Functions, a container image is created and stored in Google Artifact Registry (GAR) or Google Container Registry (GCR). If Prisma Cloud is set to scan all registries in your GCP account, Gen2 function images will be scanned. To view results, check the relevant registry and refer to Google’s naming conventions for container images here.
If Prisma Cloud is configured to scan only selected repositories, the specific repository used by Cloud Run might not be scanned. We are working to support Gen2 function scanning in this scenario.
| | **CWP-62339** |Discrepancies in Vulnerability Scan Results
In rare instances, discrepancies were observed between vulnerability scan results from Defender and Twistcli host scans.
For example, certain compliance checks identified by Twistcli were not reflected in Defender scan results, and vice versa. Additionally, for some operating systems, Twistcli reported a higher number of high-severity findings compared to Defender.
| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/known-issues-34.md?ask=