R81.20 Jumbo Hotfix Take 120

UPDATE: Check Point response to CVE-2019-6109, CVE-2019-6110, CVE-2019-6111. Refer to sk65269.

UPDATE: Added an option to disable enforcement on internal interfaces when IOC indicators are loaded.

To configure this option, add or modify [IOC] enable_internal_interface=<value> in the file $FWDIR/conf/malware_config (for MDS, additionally in $MDS_FWDIR/conf/malware_config).

UPDATE:

• Directory scanner improvements for large environments.

• Emon JSON data payload management improvements.

UPDATE: New features and improvements are released in Take 155 and Take 156 via self-updatable package. Refer to sk170314.

UPDATE: Added Take 52 and Take 53 of CPquid (QUID) Release Updates. Refer to sk181458.

UPDATE: Added Take 210 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

When running "mgmt_cli show central-license", it fails with "code: "generic_error" instead of returning the central license information.

VSX CPU Usage calculation on multi-core devices may be incorrect.

The RAD daemon may unexpectedly exit.

Mirror and Decrypt feature may not function as expected when HyperFlow is enabled.

When a Security Gateway is configured in Bridge Mode, a memory leak may occur.

HTTP parsing fails with the "Illegal header format detected: Invalid header field" error.

In rare scenarios, the Anti-Virus Software Blade fails to fetch the external intelligence feed because of an authentication failure.

In the Application Layer, an “any-any” rule (from any source to any destination, using any service) with long-lived connections may cause excessive memory usage. Refer to sk184196.

In some scenarios, the Security Gateway delays offloading a connection to the Quantum LightSpeed hardware accelerated card when SecureXL User Mode (UPPAK) is enabled.

In some scenarios, a VSX Gateway may not optimally pass traffic from a Virtual System to a Virtual Router or Virtual Switch when connections are accelerated in SecureXL.

In some scenarios, when a Security Gateway, running in SecureXL User Mode (UPPAK), receives IPv6 Neighbor Discovery Protocol (NDP) packets from the network, it may not properly forward or process them correctly.

VPN cluster members may crash after a cluster failover with BGP enabled and the exit of the USIM process.

In a rare scenario, packets with malformed message headers cause the Security Gateway to crash.

After enabling Mobile Access Software Blade on a Virtual System, Mobile Access services do not run, and the Mobile Access portal cannot be reached. Refer to sk183256.

After an upgrade, the scheduled SFTP backup configuration is not fully displayed in the "show configuration" output. Refer to sk184093.

In rare scenarios, new connections may continue matching "Prioritize Local Breakout" despite low ISP quality that should trigger a switch to backhaul.

Security Management Server and Policy Server may lose connectivity after uploading production licenses. Running "cplic print -x" on the Policy Server shows no output, while the Security Management Server output is uploaded for review.

Full Disk Encryption user update password fails with auth_type 3 (certificate and password).