Secure Web Gateway 12.2.x Release Notes

Last updated
Save as PDF

New Features in the 12.2 Release

This release provides the following new features. For resolved issues in this release and the update releases, see further below.

NOTE: Secure Web Gateway 12.2.x is provided as a controlled release.

For information about how to upgrade to this release, see Upgrading to a New Version - Controlled Release.

Rebranding to Account for Transition

Names of products, components, and other items have been rebranded to account for the transition from McAfee to Secure Web Gateway.

Rebranded SNMP SMI and MIB file with updated Org OID for Skyhigh Security

As part of the rebranding, a new Object Identifier (OID) has been introduced for Org Skyhigh Security. We are updating the SNMP OID from .1.3.6.1.4.1.1230* to .1.3.6.1.4.1.59732*. You'll need to update your management software accordingly if they are referring to these OID. For more details, see Configure event monitoring with SNMP.

Trellix VX Integration to SWG

The SWG 12.2.0 supports integration with Trellix Virtual Execution (VX). For more details, see Trellix Virtual Execution Integration to SWG.

Detection of OneNote files

New Mediatype detection has been added for OneNote files to detect .one and .onepkg files.

InsecureNetlogon

Insecure NETLOGON channel is blocked by default to explicitly allow Insecure NETLOGON, a new checkbox is provided in Windows Join Domain Dialogue. For more details, see InsecureNetlogon

TCPHealthCheck

Prior to this features, SWG would send live traffic to Next Hop Proxies to determine its health which resulted in delayed response in case Next Hop Proxy is not healthy. With this feature, SWG will have knowledge of the health of the Next Hop Proxies beforehand. For more details, see TCP Health Check for Next Hop Proxy.

ServerChunkEncoding

A new check box option is provided in proxy control event settings, which allows to enforce chunk encoding transfer on server requests from SWG. For more details, see Server Side Chunk Encoding

Connect Response Based on HTTP-Protocol

Connection Established response message always shows HTTP1.0 even if the HTTP Protocol header of the request was HTTP1.1. Now you can configure this under Proxy Control Event, where we can select to send back the Connection Established Response text based on the HTTP Protocol version received. For more details, see Configure Connection Established Response based on HTTP Protocol Version.

Support to pipelined application/HTTP

A new media type has been added to media type filtering for detection and Openers for pipelined Application/HTTP.

New Properties for Multiline Base64

To support the multiline Base-64, new properties are added in SWG

Support for kdbx-kdb-Filetype

A new media type has been added to media type filtering to detect files of the kdbx and kdb types.

Client certificate authentication for HTML UI

Client certificate authentication is now added for the HTML UI, For more details, see Client Certificate Authentication for HTML UI.

Configurable size limit of single XML attributes

The configurable size limit of single XML attributes has been increased to reduce errors on startup when having large inline lists.

Resolved Issues in the 12.2.1 Release

This release resolves known issues.

NOTE: Secure Web Gateway 12.2.1 is provided as a controlled release.

For information about how to upgrade to this release, see Upgrading to a New Version - Controlled Release.

JIRA issue numbers are provided in the reference columns.

Reference	Description
WP-3593	Login message in login dialog of HTML UI/Webstart is shown properly.
WP-4401	The import of algorithms like elliptic curves under "SSL Client Certificate Handling" is working normally as RSA restriction is removed. The supported ecparam curves are: secp256k1, secp384r1, secp521r1, prime256v1
WP-5335	A New 4500-E BIOS V7.220 is released. NOTE: To upgrade to the new BIOS V7.220, you should upgrade SWG to one of the latest versions (12.2.1, 11.2.14, and 10.2.25). These versions have the updated AMISCE that reduces the risk of incompatibility of an old AMISCE version used with the new BIOS.
WP-5537	The vulnerability CVE-2023-4400, related to Clear text storage of sensitive information is fixed. After upgrading to 12.2.1 version, It is recommended to update the previous passwords set in the Configuration files. For more details see, SB10406
WP-5551	An issue with memory leak that occurred while handling Intermediary 103 headers in HTTP2.0 for On-Prem appliance has been resolved.
WP-5578	Both body.replace and body.insert functions work fine when a file content starts with a double quotation mark (").
WP-5597	Browser is now redirected back to the original requested page, when the coaching page is displayed and the continue button clicked.
WP-5613	The memory utilization of mwg-core is reduced.
WP-5629	The default value of scan timeout in ICAP client settings is set to 600 seconds.

Announced Vulnerabilities

Reference	Description
WP-4635	This security flaw allows leak authentication or cookie header data on HTTP redirects to the same host but another port number. CVE-2022-27776, CVE-2022-27775, CVE-2022-27775, CVE-2022-22576
WP-4780	Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that a remote attacker can use to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. CVE-2022-44792, CVE-2022-44793
WP-5392	Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. CVE-2022-41974
WP-5576	Checking excessively long DH keys or parameters may be very slow. So Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. CVE-2023-3446, CVE-2023-3817
WP-5603	This flaw allows an attacker with control of the forwarded agent-socket on the server and the ability to write to the filesystem of the client host to execute arbitrary code with the user's privileges running the SSH-agent. CVE-2023-38408

Resolved Issues in the 12.2 Release

This release resolves known issues.

NOTE: Secure Web Gateway 12.2.0 is provided as a controlled release.

For information about how to upgrade to this release, see Upgrading to a New Version - Controlled Release.

JIRA issue numbers are provided in the reference columns.

Reference	Description
WP-274	A new configuration setting is added to Java UI.
WP-1016	Client certificate authentication is now added for the HTML UI.
WP-2682	Downloads with progress pages over Peering PoPs break with 502 have been resolved.
WP-4515	Receive HTTP/1.1 response for Connect HTTP/1.1 request, when configured via proxy control event
WP-4517	A new media type has been added to media type filtering to cover requests where the pipelined application/HTTP traffic is involved.
WP-4758	Improved URL scheme validation as per RFC requirement.
WP-4952	Rules that include multiple conditions with multiple IP addresses are shown correctly now.
WP-5067	Sub rule sets are no longer deleted when importing a rule set via REST API.
WP-5084	Fixed toggle button "Ignore certificate errors" in Customer Maintained list’s Setup Dialogue box.
WP-5108/WP-5170	Fixed core dump issue related to NHP and added handling of timeout in case of TLS handshake with secure NHP.
WP-5131	The configurable size limit of single XML attributes has been increased to reduce errors on startup when having large inline lists.
WP-5137	The TCP-based health check is now supported in SWG.
WP-5153	SUM tool and ipmicfg tool supports bundling with the SWG image for Next-Gen-X13-HW
WP-5154	A new environment variable is provided to control(enable/disable) creation of UnSecure Netlogon channel.
WP-5172	JSP files are not interpreted anymore but are delivered as text without additional processing except pre-compiled JSP pages.
WP-5174	A new UI option 'Connection Timeout' is introduced in ICAP client settings.
WP-5177	Correct MediaType Detection for application/x-git.
WP-5202	Snmpsa support for X13 Hardware using SD5 tool.
WP-5205	REST Interface access to System files without required Permissions has been fixed.
WP-5224	A bad gateway error while visiting some HTTP2 websites has been resolved.
WP-5225	When mirroring decrypted traffic with the SSL Tap feature, the source and destination IP addresses are not reversed.
WP-5226	Fixed performance and slowness issues caused due to an update in the Kerberos package.
WP-5239	Memory management optimizations are made for the HTTP2 SSL tap feature.
WP-5256	Webswing has been upgraded from version 20.1.16 to version 20.2.21 LTS.
WP-5261	Enhanced media type detection for SVG files.
WP-5264	Uploading a file with chunked encoding format works without problems again.
WP-5265	The maximum configurable value of ‘Connection timeout’ is now 99999 seconds in ‘Enable Proxy Control’ event.
WP-5270	An issue with downloading RTF files that led to a blocking of the download has been resolved.
WP-5281	A signature has been added for detecting the .one and .onepkg media types.
WP-5291	New properties are added to handle Multiline Base64 Strings.
WP-5295	A new media type has been added to media type filtering to detect files of the kdbx and kdb types.
WP-5300	HSM - Fixed AgentPeer socket read/write synchronization issue causing HSM operations failure on high load
WP-5304	Secure Web Gateway reports statistics information as expected, which had not worked before due to an issue with the database lock status.
WP-5338	Introduced Configurable option to enforce chunk encoding transfer towards the server.
WP-5361	When using SmartMatch the path component in an URL will now be matched in a case-insensitive manner.
WP-5365	Read-only users are now able to switch to the network interface and read the information.
WP-5367	Media type detection has been enhanced for the EML file type.
WP-5376	When a download is performed on Web Gateway Cloud Service (WGCS) under the HTTP2 protocol, use of a progress page to show the download progress no longer causes the download to fail.
WP-5377	An ENV variable has been introduced to disable ARP on interfaces where V4 is marked as disabled.
WP-5388	When an EICAR file with a test virus is embedded in a .docx file, it is extracted now and sent to the Gateway Anti-Malware (GAM) engine for scanning.
WP-5393	Fixed data truncation issue with very slow http2 server when Data trickling is enabled
WP-5398	Fixed issue where non-zero acknowledgment number field is set for packets without ACK flag
WP-5419	When the authentication process on Secure Web Gateway uses the basic NTLM authentication method, adding the default domain of the NTLM authentication server to the settings no longer leads to a failure of the process.
WP-5462	UI login issues when a large inline list is involved have been fixed.
WP-5471	ProxyHA configuration failure is fixed for SWG on Nutanix.
WP-5497	When regex terms are created for the filtering process on Secure Web Gateway, dereferencing of the null pointer does not occur anymore.
WP-5501	Anti-malware filtering on Secure Web Gateway no longer attempts to access a transaction again that has already been processed and completed.

Announced Vulnerabilities

Reference

Description

WP-3575
WP-3762,
WP-3764,
WP-3814,
WP-4147,
WP-4657,
WP-4844,
WP-4956,
WP-4958,
WP-5005,
WP-5049,
WP-5129,
WP-5164,
WP-5165,
WP-5195,
WP-5260,
WP-5273,
WP-5274,
WP-5322,
WP-5323,
WP-5369,
WP-5387,
WP-5409,
WP-5425

This Secure Web Gateway release includes updates addressing publicly disclosed CVEs, regardless of whether a CVE has been shown to impact customers.

The following medium and higher-level CVEs (CVSS 3.0 >= 4) were involved:

CVE-2020-15522
CVE-2020-13947,
CVE-2021-26117
CVE-2020-27218,
CVE-2021-28163,
CVE-2020-27223,
CVE-2021-28165
CVE-2020-15522
CVE-2021-29425
CVE-2020-36518
CVE-2022-2319
CVE-2017-9225,
CVE-2017-9229
CVE-2022-38177
CVE-2022-32532,
CVE-2022-40664,
CVE-2023-22602
CVE-2022-1552
CVE-2022-42920
CVE-2023-22809
CVE-2022-3550,
CVE-2022-3551
CVE-2022-4304,
CVE-2023-0215,
CVE-2023-0286
CVE-2022-4883
CVE-2022-4304,
CVE-2023-0215,
CVE-2022-4450,
CVE-2023-0286
CVE-2022-37434
CVE-2022-23521,
CVE-2022-41903,
CVE-2022-42252
CVE-2023-21930
CVE-2023-1393
CVE-2023-0767