Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Secure Web Gateway 12.2.16 Release Notes

New Features in the 12.2.x Release    

Below is a consolidated list of new features available across the different 12.2.x releases. For issues resolved as a part of this release, see the Resolved Issues section.

For information about how to upgrade to this release, see Upgrading to a new version – Main Release.   

Rebranding to Account for Transition    

Names of products, components, and other items have been rebranded to account for the transition from McAfee to Secure Web Gateway.

Rebranded SNMP SMI and MIB file with Updated Org OID for Skyhigh Security    

As part of the rebranding, a new Object Identifier (OID) has been introduced for Org Skyhigh Security. We are updating the SNMP OID from .1.3.6.1.4.1.1230* to .1.3.6.1.4.1.59732*. You'll need to update your management software accordingly if they are referring to these OID. For more details, see Configure event monitoring with SNMP.

Trellix VX Integration to SWG   

The SWG 12.2.0 supports integration with Trellix Virtual Execution (VX). For more details, see Trellix Virtual Execution Integration to SWG.

Detection of OneNote files  

New Mediatype detection has been added for OneNote files to detect .one and .onepkg files. 

Insecure NETLOGON   

Insecure NETLOGON channel is blocked by default. To explicitly allow Insecure NETLOGON, a new checkbox is provided in Windows Join Domain Dialogue. For more details, see Insecure Netlogon.

TCP Health Check   

Prior to this feature, SWG would send live traffic to Next Hop Proxies to determine its health which resulted in delayed response in case Next Hop Proxy is not healthy. With this feature, SWG will have knowledge of the health of the Next Hop Proxies beforehand. For more details, see TCP Health Check for Next Hop Proxy.

Server Chunk Encoding   

A new check box option is provided in proxy control event settings, which allows to enforce chunk encoding transfer on server requests from SWG. For more details, see Server Side Chunk Encoding.

Connect Response Based on HTTP-Protocol  

The Connection Established response message always shows HTTP1.0 even if the HTTP Protocol header of the request was HTTP1.1. Now you can configure this under Proxy Control Event, where we can select to send back the Connection Established response text based on the HTTP Protocol version received. For more details, see Configure Connection Established Response based on HTTP Protocol Version.

Support to Pipelined Application/HTTP  

A new media type has been added to media type filtering for detection and openers for Pipelined Application/HTTP. 

New Properties for Multiline Base64  

To support the multiline Base64, new properties are added in SWG.

Support for kdbx-kdb-Filetype  

A new media type has been added to media type filtering to detect files of the kdbx and kdb types.

Client Certificate Authentication for HTML UI  

Client Certificate Authentication is now added for the HTML UI. For more details, see Client Certificate Authentication for HTML UI.

Configurable Size Limit of Single XML AttributesEdit section 

The configurable size limit of single XML attributes has been increased to reduce errors on startup when having large inline lists.

Known Issues and Workaround 

For a list of issues that are currently known, see SWG 12.x.x Known Issues and Workaround.

Resolved Issues in the 12.2.16 Release     

NOTES:

  • Secure Web Gateway 12.2.16 is provided as a main release.    
  • If you have configured SWG in Transparent Router mode, ensure that your configuration follows the mandatory steps outlined in the Skyhigh document before upgrading to SWG version 12.2.9 or later.

For information about how to upgrade to this release, see Upgrading to a new version – Main Release.   

The following table provides Resolved Issues list with associated Jira numbers.

Reference Description
WP-1516 The VLAN interface on Skyhigh Secure Web Gateway (SWG) can be deleted from the UI as well as backend by replacing the vconfig command with delete <Vlan> ip link.
WP-6556 The Enable Outbound Source IP Override now functions with all types of IP addresses, and port 9090 is no longer appended to the URL during Web Cache Communication Protocol (WCCP) configuration, ensuring smooth request processing.
WP-6670 The Supermicro Object Identifiers (OIDs) can be queried with a response from SuperDoctor5 (SD5) Management Information Base (MIB) by enabling SD5 using the sd-enable command with a timeout of two minutes.
WP-6683 The curl: (28) SSL shutdown timeout error is fixed and logs can be pushed to the Microsoft FTP server without any errors.
WP-6686 The Pass thr rule engine ruleset enabled and created to forward CRL/OCSP requests via NHP succeeds in a proxy chain when HTTPS scanning is enabled on all the nodes.
WP-6692 The function ATreeElement::GetTimeString handling rule executions for extremely less time (<1 ms) resulting in missing or invalid duration attributes in the generated rule trace XML with yellow triangle alert now functions without any errors.
WP-6755 The Simple Network Management Protocol (SNMP) v3 user login functions correctly when the encryption method is set to None in the user interface.
WP-6820 The Composite Opener on the Skyhigh Secure Web Gateway (SWG) 12.2.14 is disabled to ensure normal CPU utilization while processing parallel PDF files.
WP-6967/WP-6968 Enhanced additional logging for the Azure AD authentication failures.

Vulnerabilities Fixed     

This Secure Web Gateway release includes updates addressing publicly disclosed CVEs, regardless of whether a CVE is shown to impact customers.
The following medium and higher-level CVEs (CVSS 3.0 >= 4) were involved:

Reference CVE  Description
WP-6372 CVE-2023-20860 Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
CVE-2023-20861 In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a Denial-of-Service (DoS) condition.

For resolved issues on the previous releases and other information, see Secure Web Gateway 12.2.x Release Notes 

  • Was this article helpful?