R81.20 Jumbo Hotfix Take 90

NEW: Local SCV settings can be customized by Security Gateway when creating a $FWDIR/conf/local.scv_<GW NAME> file, otherwise the settings fall back to the standard local.scv configuration.

UPDATE: Resolved CVE-2024-3596 - Blast-RADIUS attacks. Fix for Remote Access VPN and login to SmartConsole, Mobile Access and Identity Awareness Captive Portal. Refer to sk182516.

UPDATE: JRE is updated from version 8.0_8.21 to version 8.0_8.26.

UPDATE: Added a count of Session and Connection logs to the "cpstat" command output.

UPDATE: Added support for log rotation in the avi_del_tmp_files.elg files. Refer to sk113241.

UPDATE: The maximum size for files uploaded to Threat Emulation can now be configured using the Threat Emulation API. Set the "max_api_request_data_size" attribute to specify the new limit.

UPDATE:

• Improved debugging in the Security Gateway to identify problematic hosts when resolving their next-hop IP addresses.

• The custom ADP queue size configuration now persists after rebooting the Security Gateway. The relevant global parameters are located in the $PPKDIR/conf/adpkern.conf file:

  • "adp_nh_total_max_arp_qents"

  • "adp_nh_local_max_arp_qents"

UPDATE: New features and improvements are released in Take 121 and Take 123 via self-updatable package. Refer to sk170314.

UPDATE: Added Update 15 of Threat Extraction Engine. Refer to sk165832.

UPDATE: Added Take 40 of CPviewExporter Release Updates. Refer to sk180521.

In some scenarios, the "set-exception-group applied-threat-rules.position" Management API command may add the exception group to an incorrect position.

An administrator whose authentication method was changed from "Check Point Password" to a different method in R77.X can still log in using their original Check Point password.

Adding a host object to a network group using the "set-host" Management API command may generate large redundant audit logs.

SmartConsole may get disconnected when installing a policy on more than five hundred targets.

Global Policy Reassignment may fail with an "An internal error has occurred" message when a custom IPS package is used or was previously used in the system.

When exporting a policy to CSV with hitcount enabled, if the hitcount timeframe is set to anything other than "All", the "Hitcount" column in the CSV file may appear blank.

In some scenarios, Access Control policy verification is stuck at 40 percent.

Changing the main URL of the UserCheck Portal using the "set simple-gateway" Management API command fails with "DNS failed to resolve the hostname: gateway name" Executed command failed. Changes are discarded".

Several Management API commands, such as "show-package" and "install-policy", may fail if running them after the deletion of a cluster member.

In some scenarios, in a Multi-Domain Security Management environment, the Hit Count retention mechanism may not remove the Hit Count data from all the Domains.

In rare scenarios, objects are missing from the Gateways & Servers view on the Multi-Domain Security Management level. Refer to sk182641.

In rare scenarios, login to a Domain from the System Domain in Smart Console fails with "Login to the Domain domainName failed. Try again, or connect directly to the Domain using its IP addressdomainIp".

In some scenarios, cpmiquerybin core files may appear in /var/log/dump/usermode/ on the Security Management Server.

SmartConsole fails to connect with "Unable to connect to server. Server is initializing". Refer to sk182507.

In rare scenarios, CPU consumption on the Security Management Server is high and logs are not displayed.

In rare scenarios, the FWK process may unexpectedly exit when the IPS / Application Control / Anti-Virus / Anti-Bot blade is active and the HyperFlow feature is enabled.

Changing the NAT settings of a host using the "set-host" Management API command succeeds but has no effect unless both the "ipv4-address" and "ipv6-address" parameters are set.

When SecureXL User Mode (UPPAK) is enabled and using Passive/Active Streaming with QoS, the Security Gateway may incorrectly drop some traffic.

In a rare scenario, the FWK process may exit when cluster connection synchronization fails.

When adding a new Virtual System, a CPD core dump file may be generated.

Traffic through specific interfaces is dropped when the QoS blade is active and "ISP redundancy-LS" is configured. Refer to sk182807.

See the Important Notes section.

Threat Prevention policy installation may fail because of invalid JSON format in the IoC feed feature configuration file. Refer to sk181650.

In some scenarios, when loading large IoC IP feeds, policy installation may fail with "Installation failed. Reason: Policy install commit function was unsuccessful due to timeout" because of a large IP addresses list.

In a rare scenario, the Security Gateway may crash during traffic inspection when holding a connection.

In some scenarios, when Zero Phishing is enabled, kernel crash may occur.

The fwk.elg file may be flooded with the "DNS_DATA_SOURCE failed on context 201, executing context 366 exception" messages. Refer to sk182606.

IPS may drop an IPv6 TCP local connection.

High volumes of simultaneous requests for the same domain or URL may cause Anti-Virus blades to put excessive load on the RAD daemon, leading to increased latency.

Anti-Virus may execute unnecessary load_sigs when loading external IoC feeds.

IPX traffic over the interface in Bridge Mode working in SecureXL User Mode (UPPAK) may be dropped. Refer to sk182623.

When working with Jumbo Frames in SecureXL User Mode (UPPAK) on Quantum Force 9000 series appliances, incorrect memory allocation calculations may cause intermittent link failures. Refer to sk182825.

The USIM process may occur if CPView stats are collected during the "cpstop" operation for VSX.

In some scenarios during low TCP traffic, there is high CPU usage when SecureXL User Mode (UPPAK) is enabled.

The USIM process exits when attempting to delete an IP address from an empty deny list if that IP address exists in any other deny lists (including the regular deny list or those using IoC feeds).

In a ClusterXL environment, a race condition may occur when BGP Graceful Restart is incorrectly configured. If the feature is enabled for some peers but not others, it may lead to permanent loss of network routes.

The FWK process may exit when Monitor mode is enabled on one of the interfaces.

When working with iOS devices, after establishing a VPN connection and subsequently disconnecting devices, the "vpn tu tlist" command may display an incorrect device connection status, indicating that a device is still connected.

Multi-Queue configuration does not survive reboot on VSX. Refer to sk173950.

In some scenarios when MDPS is enabled, the "Loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-eth7 instead" message appears in /var/log/messages.

Running the "snmpwalk" command on OID .1.3.6.1.4.1.2620.1.6.23 causes snmpwalk on OID 1.3.6.1.4.1.2620.1.6.7.6.1 to show wrong output. Refer to sk182315.

The "Unable to connect to the server, Press OK to reconnect" error is displayed when opening the Network Interfaces tab in the Gaia Portal. Refer to sk182560.

During patch deployment in Posture Management, attempting to patch multiple systems for a specific application using the "Group By Application" option fails with the "Failed to Start Patching Process" error.

When creating multiple Interoperable Devices with dynamic IP addresses, the duplicate IP addresses may be assigned to Interoperable Devices. Refer to sk181834.

The VSX Gateway may cause traffic interruption when SecureXL User Mode (UPPAK) is enabled on systems with multiple physical interfaces.

Disabling the Maestro Fastforward feature may result in an error.

In a Maestro environment, when MDPS is enabled, the "asg if --diag" command reports the "no files matched glob pattern "/sys/class/net/BPEth*/operstate" error.