R81.10 Jumbo Hotfix Take 170

UPDATE: Resolved CVE-2024-31497. The Putty version used in the Mobile Access Portal Embedded SSL Network Extender application is upgraded from version 0.80 to version 0.81.

UPDATE: Optimized the Generic Data Center JSON file processing on the Security Gateways to improve performance when handling large numbers of IP ranges.

UPDATE: Port 8211 now accepts connections with the cipher ECDHE_RSA_AES_256_GCM_SHA384.

UPDATE: Added a log for connections rejected because of short Server certificate public key size (RSA 1024 bits or less, ECDSA 256 bits or less). Refer to sk182224.

UPDATE: New features and improvements are released in Take 118 , Take 119, Take 120 via self-updatable package. Refer to sk170314.

The database size on the Secondary Management Server increases if dbedit is used without making or saving any changes. Refer to sk182519.

The Revisions Purge process may stall if initiated after restarting the Security Management Server or Multi-Domain Security Management Server because of remnants of a previously interrupted Revisions Purge operation.

In rare scenarios, login to SmartConsole fails with a timeout.

Accelerated Policy installation may get stuck with the "Policy installation (queued)" status.

If the $FWDIR/conf/fwm.adtlog file is not valid, the FWM process leaves unused file descriptors, which may affect the Security Management Server performance.

In rare scenarios, the FWM process on the Security Management Server may unexpectedly exit, creating a core dump file.

In rare scenarios, the CPD process may unexpectedly exit and create a core dump file.

Global Domain Assignment may fail with "Internal Error", if the assigned Domain is currently Active on a different Multi-Domain Security Management Server.

In a rare scenario, when running the CPView utility, the Security Gateway may crash.

When adding a table widget to a SmartView report:

• The "Missed Malware Activity" and "Spyware Action" fields may not be possible to pick.

• The "Malware Action" filter may appear twice in the picker. Refer to sk182049.

In rare scenarios, the CPSEMD process on the SmartEvent Server may unexpectedly exit, creating a core dump file.

In rare scenarios, the Logs view may display unexpected blank lines or gaps in the chronological sequence of entries.

In a VSX Cluster environment, the CPVIEWD daemon may cause a high CPU.

Incorrect value in the "fwisusfw" register causes improper CPU affinity and dynamic balancing initialization in User Space Firewall mode after an upgrade. Refer to sk182004.

In rare scenarios, policy installation may fail after an upgrade of a VSX Gateway.

SSH Deep Packet Inspection (SSH DPI) fails to start inspection if IPS is enabled while all other threat prevention products are disabled.

When using ICAP, filename handling occasionally fails. As a result, the Threat Emulation Blade may not be able to process this specific file.

The Anti-Bot Blade may generate error logs with the "Failed to Decrypt CP Site Response" reason. Refer to sk182494.

The "citrixStrictTicketEnforcement" parameter set in the configuration file may not work as expected.

In a rare scenario, a memory leak in the adp kernel module may occur during multicast routing assert failures.

When SecureXL User Mode (UPPAK) is enabled, in some scenarios, a VSX Security Gateway with many Virtual Systems may crash.

Dynamic Routing outage in a Security Group during the Zero Downtime (MVC) Upgrade to R81.20, during the Downgrade from R81.20, or during the installation / uninstall of the R81.20 Jumbo Hotfix Accumulator. Refer to sk182556.

A multicast outage may occur during failovers caused by interface flaps.

Remote Desktop Protocol (RDP) connections may frequently disconnect when network traffic is routed through a combination of medium path, Quality of Service (QoS) controls, and VPN.

The FWK process may crash when establishing multiple VPN tunnels simultaneously at peak rates.

The FWK process may exit when Monitor mode is enabled on one of the interfaces.

In Quantum Maestro/Scalable Chassis environments, when using the Threat Prevention Blade in the Security Group, the entitlement_status_collector_db.C files may be inconsistent between the Security Group Members.