Secure Web Gateway 12.2.24 Release Notes

Last updated
Save as PDF

The Skyhigh SWG 12.2.24 release enhances performance, security, and infrastructure for Skyhigh Secure Web Gateway. These updates streamline administrative workflows, improve real-time system troubleshooting, and reduce network overhead through efficient protocol handling. The expanded media support improves your security posture by blocking modern threat vectors, while PAM RADIUS integration and updated Ubuntu KVM compatibility maximize your enterprise deployment flexibility.

For details on the issues resolved in this release, see the Resolved Issues section.

How to Download and Upgrade Skyhigh SWG 12.2.24

SWG 12.2.24 is available as a main release. You can download the build from the Content & Cloud Security Portal. For information about upgrading, see Upgrading to a new version – Main Release.

What's New in This Release

This release introduces the following enhancements:

REST API Support for Changing User Password : Skyhigh Secure Web Gateway now supports changing local user account passwords through a REST API. For more details, see Changing a User Password.
Detect New Media Types:

The SWG supports detection of the following new media types:

FCM
Wasm
Mach-O 64-bit executable and MacOS Installer package file
GPT Disk Image
jose and jose+json

For more details, see Secure Web Gateway (SWG) Supported MIME Types.

Enhancements to Data Collection for Troubleshooting : Skyhigh Secure Web Gateway (SWG) now allows automated troubleshooting data collection through the mwgResInfo utility, triggered by pre-defined system thresholds. For more details, see Automated Diagnostic Data Collection.
Optimized SSLTap Handling for HTTP/2: Optimized HTTP/2 traffic handling during SSLTap to reduce network overhead by aggregating small protocol frames.
Added Support for Non-Local User Account Authentication via PAM Radius: Added support for authenticating non-local user accounts via PAM Radius in the libswgpam-nss library on Skyhigh Web Gateway. For more details, see PAM RADIUS Solution for Non-Native SWG Users.
Extended SWG KVM Platform Support to Ubuntu: SWG on KVM now extends platform support to Ubuntu 24.04 broadening deployment options for newer Ubuntu releases. For more details, see Supported Virtual and Cloud Platforms.

Resolved Issues

For details about resolved issues in previous releases and other related information, see Secure Web Gateway 12.2.x Release Notes.

NOTE: If you have configured SWG in Transparent Router mode, ensure that your configuration follows the mandatory steps outlined in the Configure Proxy Settings for a Director Node in Transparent Router Mode before upgrading to SWG version 12.2.9 or later.

The following table lists the resolved issues fixed in the 12.2.24 release:

Reference	Description
WP-5934	Resolved an issue where connection diagnostic traces were not generated for HTTP/2 traffic when using IVX/ICAP scanning.
WP-7751	Fixed an issue where a USB network interface appeared incorrectly in the Network Interfaces configuration on hardware appliances (F models) when a USB device was connected during installation.
WP-8151	Perl script is now identified as perl script even when it has application/pdf content.
WP-8164	Updated the Bouncy Castle cryptographic library to version 2.73.10 LTS to address known security vulnerabilities.
WP-8171	SWG installation wizard now includes an option to select IPv6 network configuration.
WP-8183	IPv6 address formatting in log entries now conforms to RFC 5952 standard.
WP-8184	SNMP Trap notifications now correctly display IPv6 source addresses instead of IPv4 local addresses.
WP-8187	IPv6 URL validation for the update server in SWG.
WP-8212	No more failure in Health CheckServersList validation on IPv6 entries.
WP-8218	Removed weak CBC cipher suite from cluster communication to strengthen encryption security.
WP-8278	Fixed an issue where the alternative update server URL field incorrectly enforced a non-empty value after a fresh install.
WP-8301	SWG now supports the detection of jose and jose+json and classifies them as application/jose and application/jose+json.
WP-8331	Resolved a memory management issue where the proxy could become unresponsive over time, requiring periodic restarts.
WP-8352	SWG now supports the detection of GPT Disk Image containing a APFS file system and classifies them as `application/x-gpt-apfs-disk-image` and `application/x-gpt-disk-image`.
WP-8354/ WP-8353	SWG now supports the detection of Mach-O 64-bit executable and macOS Installer package and classifies them as application/x-mach-o-executable and application/vnd.apple.installer+xml.
WP-8400	Improved handling of CONNECT requests with next-hop proxy by correctly ignoring content-length and transfer-encoding headers per protocol specification.
WP-8489	Fixed an issue where temporary CRL files were not cleaned up in the `CertificateFilterPlugin` directory following an ungraceful shutdown. SWG now automatically removes orphaned temp files from plugin data directories on startup.
WP-8502	Extend SWG on KVM support to Ubuntu 22.04 and 24.04.
WP-8510	Fixed an issue in SVG file detection logic where a SVG was not detected as SVG file.
WP-8521	Fixed an issue where moving policy rules could unintentionally toggle the enabled/disabled state of other rules.
WP-8592	Optimized HTTP/2 traffic handling to reduce network overhead by aggregating small protocol frames.
WP-8624	Fixed a stability issue where deeply nested OLE files could cause a system crash by implementing strict recursion and path length limits.
WP-8629	Resolved a conflict between Real-Time Service (RTS) and Bandwidth Throttle features that prevented RTS from starting correctly.
WP-8648	Reduced latency in SNMP query responses on F hardware models.
WP-8649	Fixed an issue where HTTP/2 traffic could cause excessive temporary disk or memory usage.
WP-8671	Fixed an infinite loop in the ICAP server that caused the proxy to hang when policy made an early block decision during the preview phase of a REQMOD or RESPMOD request with an encapsulated body.
WP-8702	Fixed certificate chain configuration in the SWG management interface web server.
WP-8713	Resolved high CPU usage caused by connections that were not properly terminated in the proxy event system.
WP-8774	SWG now supports the detection of `wasm` file and classifies them as `application /wasm`.
WP-8775	SWG now supports the detection of `FCM` files and classifies them as `application/x-brother-fcm`.
WP-8779	Added REST API endpoint for local account password rotation, enabling integration with enterprise credential management tools.
WP-8780	Fixed inconsistent geolocation results from URL Filter where the same IP address could return different country codes within a single session.
WP-8785	Improved handling of HTTP 103 Early Hints responses for HTTP/2 connections.
WP-8817	Resolved SWG upgrade failure caused by a Quagga routing package dependency issue.
WP-8838	Enhanced the SWG health monitoring and diagnostics script with new features and options.
WP-8852	Upgraded the `libgcc` system library to version 4.8.5-45.0.1.
WP-8869	Improved stability of the SNMP trap service during shutdown operations to prevent crashes.
WP-8880	Fixed missing USB network interface on hardware F-models.
WP-8892	Fixed SMTP email notifications to work correctly with IPv6 mail servers.
WP-8907	`libswgpam-nss`: Created PAM/NSS authentication library package.
WP-8950	Fixed a stability issue which is related to SSL inspection with HTTP/2 traffic.
WP-8987	Updated the name service caching component to resolve compatibility issues introduced by the system library upgrade.
WP-9052	Fixed HTTP/2 file download failure that could occur with clients using larger flow control window sizes.

Vulnerabilities

CVE and package details are now available on the Content Security Portal and are restricted to Skyhigh customers.

Known Issues and Workarounds

For a list of issues that are currently known, see SWG 12.2.x Known Issues and Workaround.