5.x Release Notes

**Delayed strategy:**

cat <<EOF | kubectl apply -f -
apiVersion: coordination.k8s.io/v1
kind: Lease
metadata:
  name: neuvector-controller
  namespace: neuvector
spec:
  leaseTransitions: 0
---
apiVersion: coordination.k8s.io/v1
kind: Lease
metadata:
  name: neuvector-cert-upgrader
  namespace: neuvector
spec:
  leaseTransitions: 0
EOF

#### 5.3.4 July 2024

##### Bug Fixes
+ The `host` and `tunnel` interface are successfully retrieved with OpenShift CLI v4.15.
+ The IP range 169.254.x.x is excluded from the host interface IPs.
+ Reexam host interface after 1 minute of enforcer startup.
+ Fixed an issue where the OpenID issuer URL regex was failing.

+ Remediates following CVEs:

<table>
  <tr>
    <th>CVE</th>
    <th>Applies to</th>
    <th>Impact</th>
  </tr>
  <tr>
    <td>CVE-2023-42364</td>
    <td>busybox</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2023-42365</td>
    <td>busybox</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-6197</td>
    <td>curl</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-6874</td>
    <td>curl</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-5535</td>
    <td>openssl</td>
    <td>🔴 Critical</td>
  </tr>
  <tr>
    <td>CVE-2024-4741</td>
    <td>openssl</td>
    <td>🟡 Medium</td>
  </tr>
</table>

#### 5.2.4-s5 July 2024

+ Remediates following CVEs:

<table>
  <tr>
    <th>CVE</th>
    <th>Applies to</th>
    <th>Impact</th>
  </tr>
  <tr>
    <td>CVE-2023-42363</td>
    <td>busybox</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2023-42364</td>
    <td>busybox</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2023-42365</td>
    <td>busybox</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2023-42366</td>
    <td>busybox</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-6197</td>
    <td>curl</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-6874</td>
    <td>curl</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-5535</td>
    <td>openssl</td>
    <td>🔴 Critical</td>
  </tr>
  <tr>
    <td>CVE-2024-4603</td>
    <td>openssl</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-4741</td>
    <td>openssl</td>
    <td>🟡 Medium</td>
  </tr>
</table>

#### 5.3.3 June 2024

##### Enhancements
+ Allow users to block the usage of specific storage classes from the `Admission Controls` page.
+ The `LDAP Authentication` has separated fields for `baseDN` and `groupDN` configuration.
+ The `Egress and Ingress chart` has a new vulnerability column which contains the `High` and `Medium` vulnerability count for each service.

##### Bug Fixes
+ Fixed bug related to `regex` when using a comma (`,`) in a multi-entry `Admission Control user criteria`.
+ Fixed bug where the CVE scan of `jar` packages would not show all packages affected by a same CVE. Now all occurences are reported.
+ Remediates following CVEs:

<table>
  <tr>
    <th>CVE</th>
    <th>Applies to</th>
    <th>Impact</th>
  </tr>
  <tr>
    <td>CVE-2024-35195</td>
    <td>python:requests</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-21011</td>
    <td>openjdk11</td>
    <td>🟢 Low</td>
  </tr>
  <tr>
    <td>CVE-2024-21012</td>
    <td>openjdk11</td>
    <td>🟢 Low</td>
  </tr>
  <tr>
    <td>CVE-2024-21068</td>
    <td>openjdk11</td>
    <td>🟢 Low</td>
  </tr>
  <tr>
    <td>CVE-2024-21085</td>
    <td>openjdk11</td>
    <td>🟢 Low</td>
  </tr>
  <tr>
    <td>CVE-2024-21094</td>
    <td>openjdk11</td>
    <td>🟢 Low</td>
  </tr>
</table>

##### Other
+ Allow users to set resources for `updater-cron-job` when installing NeuVector with the Helm chart.
+ Prometheus exporter container versioning reviewed and dissociated to the `controller` versioning.
+ (Scanner) Detect the `R` package/module in Ubuntu and Red Hat Enterprise Linux.
+ (Scanner) Added support for PHP Composer scan.

#### 5.2.4-s3 April 2024

+ Remediates following CVEs:

<table>
  <tr>
    <th>CVE</th>
    <th>Applies to</th>
    <th>Impact</th>
  </tr>
  <tr>
    <td>CVE-2021-40633</td>
    <td>giflib</td>
    <td>🟠 High</td>
  </tr>
  <tr>
    <td>CVE-2023-48161</td>
    <td>giflib</td>
    <td>🟠 High</td>
  </tr>
  <tr>
    <td>CVE-2024-28757</td>
    <td>expat</td>
    <td>🟠 High</td>
  </tr>
  <tr>
    <td>CVE-2023-39742</td>
    <td>giflib</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2023-45288</td>
    <td>go:golang.org/x/net</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-25629</td>
    <td>c-ares</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-3651</td>
    <td>python:idna</td>
    <td>🟡 Medium</td>
  </tr>
  <tr>
    <td>CVE-2024-2511</td>
    <td>openssl</td>
    <td>🟢 Low</td>
  </tr>
</table>

#### 5.3.2 April 2024

##### Bug Fixes

+ After upgrading to v5.3.1 from a previous NeuVector release, pre-existing NvClusterSecurityRule custom resources may be deleted inadvertently. NOTE: The 5.3.1 version has been removed from docker hub in order to prevent the upgrade issue.

#### 5.3.1 April 2024

:::danger[important]
The 5.3.1 version has been removed from docker hub in order to prevent the upgrade issue fixed in 5.3.2. Please use the 5.3.2 release.
:::

##### Enhancements
+ Allow users to define ‘accepted’ vulnerabilities when using Github actions so they don’t affect workflows.
+ Add Severity, Score level and Feed Rating filters to Assets > Registry > Image Vulnerabilities view.
+ Allow when configuring a registry if it should use the defined proxy for the registry image scans.

##### Bug Fixes
+ Security Risks > Vulnerabilities > Advanced Filter doesn't filter 'CVE without Fix'
+ Unexpected violation from container to hostmode container
+ Accept OCI image format when switching to docker api 1.24
+ Registry Scan should not scan non-image artifacts / not log an error
+ Allow for rootless key pair image signature verification without internet or sigstore dependence.
+ Security Events not getting permitted by network rules in a specific node (related to "Container Task chan full" error messages)
+ Container is unable to add to workload successfully (frequent occurences). Resulting from deadlock from channel messages.

##### Other
+ Update the scanner plugins for Jenkins, GitHub action, and Bamboo.
+ (Scanner) Accept OCI image format when switching to docker api 1.24.
+ (Scanner) Registry Scan should not scan non-image artifacts / not log an error.
+ (Scanner) Add support for php composer scan.

#### NeuVector UI Extension v. 1.0 for Rancher March 2024

+ After installation of NeuVector, [enabling/installing](/deploying/rancher#neuvector-ui-extension-for-rancher) the NeuVector UI Extension from Rancher will display a Dashboard for the cluster, including links to SSO to the full NeuVector cluster. NOTE: The extension may display as Third Party, which will be fixed in a future release. Also, after installation, Rancher 2.7.x users may see two NeuVector UI Ext icons in the list (bug). One icon will say Uninstall (meaning it is installed), and the other should say Install. This can be left as is, ie, don't Install again if the extension is already installed.

#### 5.2.4-s2 February 2024

+ Remediates following CVEs:
+ High cve: CVE-2023-52425 in expat, CVE-2024-20952 and CVE-2024-20918 in openjdk11
+ Med cve: CVE-2023-52426 in expat, CVE-2024-20926, CVE-2024-20921, CVE-2024-20945 and CVE-2024-20919 in openjdk11, CVE-2024-0727 and CVE-2023-6237 in openssl

#### 5.3.0 February 2024

#####Enhancements
+ Show external destination URLs (FQDN) in Dashboard (egress), PDF and CSV reports, as we well as in Network Activity screen and Security Events (violations) lists
+ In Discover mode, learn egresses to external FQDN address groups automatically. A new external FQDN custom group will be created unless the external connection matches an existing rule.
+ Enable ICMP learning (Discover mode) and blocking (Protect mode) through new Controller environment variable CTRL_EN_ICMP_POLICY = 1
+ Export CRDs into Github to support gitops to a default repo using console or REST API.
+ Support SAML SSO single logout with ADFS iDP
+ Add support for ARM64 platform. Pulling from ARM based platforms will automatically pull the appropriate ARM64 NeuVector images.
+ Support webhooks through a proxy
+ Improve admission control auditing function to include results of all rules. List the result of every rule, and adds another entry for the final action the would occur when evaluated in a live admission control deployment.
+ Apply disabled Admission Control rules via CRD or yaml (kubectl)
+ Vulnerability Profile export / import through console, CRD, or REST API. Importing will replace the existing profile. Deleting the CRD will result in an empty profile.
+ Compliance Profile template export / import through console, CRD, or REST API. Importing will replace the existing template.
+ Add a 'Manual' status in the compliance reports for CIS benchmarks that must be run manually by users (not run by NeuVector).
+ Improve UI loading/performance of Vulnerabilities page
+ Unify browser session login. With this, all tabs in the browser share the same login session, opening a new tab from an existing session does not ask for credentials, and when one tab logs out, all tabs are logged out.
+ Enhancements to security of console (UI): 1) add mandatory security headers (X-Content-Type-Options nosniff; X-XSS-Protection 1; mode=block; X-Frame-Options SAMEORIGIN; Cache-Control private, no-cache, no-store, must-revalidate
HTTP Strict Transport Security max-age=15724800, 2) add CSP header (e.g. set a ‘default-src’ directive), 3) remove server name disclosure
+ Support newer versions of CIS benchmarks. Kubernetes (1.8.0), Kubernetes V1.24 (1.0.0), Kubernetes V1.23 (1.0.1), RedHat OpenShift Container Platform (1.4.0)
+ Show in Assets -> Containers -> Container details containers which were scanned in registries versus runtime
+ Add link to Group in Security Risks -> Vulnerabilities -> Impact popup to easily edit group mode
+ Support deep linking in URL's to image and/or container vulnerability page 
+ Add password reset option for admin to reset user password in console Settings -> Users
+ Allow sending event logs to controller pod logs in Settings -> Configuration -> Notification. The events sent will begin with 'notification=' and be saved only to the leader controller pod. Note that there is a bug in this version where, in order to change the event level SYSLOG must be enabled (and can be disabled if desired after changing the level).
+ Remove requirement for controller/enforcer to mount "/host/cgroup".
+ Add Get Support menu with links to slack, documentation, and other resources
+ Fill message field to /v1/log/activity logs

#####Bug Fixes
+ Internal Server Error in Security Risks -> Vulnerabilities with a high number of CVEs 
+ SIGSEGV: segmentation violation on controller
+ Deleting vulnerable files (e.g. jar) doesn't remove from vulnerability list
+ Invalid Syslog certificate using the signature algorithm SHA256withECDSA
+ NeuVector shows security events that should be allowed by a Network Rule 
+ Un-managed node with "zombie" enforcer running 
+ Advanced Filter shows Remediation and Impact fields blank
+ Fix string handling to prevent unexpected Enforcer restart
+ Unexpected violations relating to built-in groups 
+ Support-bundle enforcer debug RPC call for data returns error 
+ Group is not matching in Security Events 
+ Send events to slack is not working - with proxy 
+ Showing security events for allowed network rules 

#####Other
+ Add run-time container engine (socket) automatic detection to Helm chart
+ Remove setting for running controller in privileged mode in Helm chart, and requirement for controller/enforcer to mount "/host/cgroup".
+ The sample kubernetes deployment files have been removed from the NeuVector docs. Please refer to the link for examples.

#####Highlighted Changes Which May Require Changes for Manual Deployments (all changes are already reflected in latest Helm chart for 5.3.x)
+ Auto detection of container run-time (socket) removes the need to specify the container run-time and socket path.
+ Removal of requirement to run the controller in privileged mode removes the need for mounting runtime socket and mounted /host/cgroup/
+ Added role/role binding for neuvector-binding-secret as well as neuvector-secret in yaml.
+ New service accounts and role bindings required for 5.3
+ All referenced deployment yaml files now have /5.3.0/ in their paths

#### 5.2.4-s1 January 2024

##### Security Patch Release

+ Remediates CVE-2023-6129 in openssl, and CVE-2023-46219, CVE-2023-46218 in curl.

#### 5.2.4 November 2023

##### Bug Fixes

+ Azure AKS ValidatingWebhookConfiguration changes and error logging.

#### 5.2.3 November 2023

##### Enhancements

+ Add support for NVD API 2.0 in Scanner.
+ Scan the container host in scanner standalone mode.

```shell
docker run --rm --privileged --pid=host neuvector/scanner -n

Release Notes for 5.x​

5.4​

New Features:​

Bug Fixes:​

Known Issue:​

Bug Fixes​

5.2.2-s1 October 2023​

Security Update​

5.2.2 October 2023​

Security Advisory for CVE-2023-32188​

Enhancements​

Bug Fixes​

5.2.1 August 2023​

Enhancements​

Bug fixes​

5.2.0 July 2023​

Enhancements​

Bug Fixes​

Other​

5.1.3 May 2023​

Enhancements​

Bug Fixes​

Scanner Sample Output​

5.1.2 March 2023​

Enhancements​

Bug Fixes​

Other​

5.1.1 February, 2023​

Enhancements​

Bug Fixes​

Other​

5.1.0 December, 2022​

Enhancements​

Bug Fixes​

5.0.6-s1 March, 2023​

Bug Fixes​

5.0.6 February, 2023​

Bug Fixes​

5.0.5 November, 2022​

Bug Fixes​

5.0.4 October, 2022​

Security updates​

Enhancements​

Bug Fixes​

5.0.3 September, 2022​

Enhancements​

Bug Fixes​

5.0.2 July 2022​

Enhancements​

Bug Fixes​

5.0.1 June 2022​

Enhancements​

Bug Fixes​

CVE Remediations​

Details on SELinux Support​

5.0.0 General Availability (GA) Release May 2022​

Enhancements​

Bug Fixes​

Other Updates​

Upgrading from NeuVector 4.x to 5.x (prior to 5.2.x)​

Beta 1 version released April 2022​

Preview.3 version released March 2022​

Enhancements​

Bug Fixes​

Preview.2 version released Feb 2022​

Support for deployment on AWS ECS Deprecated​

5.0 'Tech Preview' January 2022​

Enhancements​

Bug Fixes​

Other​

Release Notes for 5.x

5.4

New Features:

Bug Fixes:

Known Issue:

Bug Fixes

5.2.2-s1 October 2023

Security Update

5.2.2 October 2023

Security Advisory for CVE-2023-32188

Enhancements

Bug Fixes

5.2.1 August 2023

Enhancements

Bug fixes

5.2.0 July 2023

Enhancements

Bug Fixes

Other

5.1.3 May 2023

Enhancements

Bug Fixes

Scanner Sample Output

5.1.2 March 2023

Enhancements

Bug Fixes

Other

5.1.1 February, 2023

Enhancements

Bug Fixes

Other

5.1.0 December, 2022

Enhancements

Bug Fixes

5.0.6-s1 March, 2023

Bug Fixes

5.0.6 February, 2023

Bug Fixes

5.0.5 November, 2022

Bug Fixes

5.0.4 October, 2022

Security updates

Enhancements

Bug Fixes

5.0.3 September, 2022

Enhancements

Bug Fixes

5.0.2 July 2022

Enhancements

Bug Fixes

5.0.1 June 2022

Enhancements

Bug Fixes

CVE Remediations

Details on SELinux Support

5.0.0 General Availability (GA) Release May 2022

Enhancements

Bug Fixes

Other Updates

Upgrading from NeuVector 4.x to 5.x (prior to 5.2.x)

Beta 1 version released April 2022

Preview.3 version released March 2022

Enhancements

Bug Fixes

Preview.2 version released Feb 2022

Support for deployment on AWS ECS Deprecated

5.0 'Tech Preview' January 2022

Enhancements

Bug Fixes

Other