8.9.0 Release Updates

Policy Management - Synchronize

A new policy synchronization indicator has been added to the Project Details screen. This option provides the capability to manually synchronize all scans for a specific project to the latest policy definition, therefore providing you with the most updated policy status for your project. The ‘Unsynced’ status indicates that synchronization is required. Once synchronization is complete, the status changes to ‘Synced’ with the last sync date and time displayed.

For M&O Layer SQL server connectivity, both Dynamic and Static port configurations are now supported. 

The CxOSA Settings panel has been removed from the CxSAST General Settings (Management > Application Settings > General) and has been relocated to its own menu item. (Management > Application Settings > OSA Settings).

The OSA Policy drop-down selection box has been removed from the CxOSA properties in the Projects screen (Projects & Scans > Projects > OSA tab) and has been relocated to the General tab.

A new indicator (CxOSA scan in progress) has been added to the top bar in the CxOSA Viewer. This indicator notifies you about one or more CxOSA scans in progress for a specific project.

A new health check option (Test Connection) has been added to the CxOSA Settings screen in the CxOSA Viewer. This option enables you to perform a connection/validataion test for the following CxOSA components;

• Connect to CxProxy
• Connect to CxOSA Engine
• Validate Organizational Token
• Connect to CxOSA Services

Each tested component will indicate either successful or failed connection/validation.

A number of textual changes have been incorporated into the CxOSA Viewer and CxOSA Report:

• CxOSA Viewer - ‘Undetected Libraries’ option text has been changed to ‘Unrecognized Libraries’.
• CxOSA Report - ‘High-Medium Risk Licenses’ report text has been changed to ‘License at Legal Risk'.

A new look and feel has been introduced to the CxAudit Workspace. The new CxAudit Workspace provides the following:

• Ability to search for a project by project name
• Projects listed according to latest scan
• Scans sorted by scan date and time
• Scan results summary
• Improved performance on page load

Unified Policy management has been included in this new version, which includes the new Violations dashboard.

Unified Policy management now allows you to define policies that apply to CxSAST and CxOSA (with new rule types for CxSAST - 'Vulnerability' and 'Risk Score' - as well as respective new conditions & values), assign multiple policies to projects, and review and track policy violations via the dedicated violations dashboard.

Policy Violations Dashboard

The Policy Violations Dashboard provides the ability to track policy violations per project, and now supports:

• Filter by Policy Name
• Search by Project Name

New functionality for the API set has been added to latest Policy Management API library version.

• Get All Projects (v1.0)
• Create Violations Report for Project by Id (v1.0)
• Get All Assigned Projects by Policy Id (v1.0)

The Azure DevOps (MS-VSTS) Plugin Change log has moved to a new location.

If not already accepted during the CxSAST/CxOSA installation and setup, in order to perform an CxOSA scan from within the plugin, the EULA must be already have been accepted in the CxSAST / CxOSA Web interface. In all Checkmarx plugins the following message is raised; ‘In order to start working with CxOSA, your CxSAST Administrator needs to accept the End User License Agreement (EULA) from the CxSAST / CxOSA web interface.’

Note that you are unable to start using CxOSA unless the end user license agreement (EULA) has been viewed and accepted

A new parameter (Enable project’s OSA policy enforcement) has been added to this version of all Checkmarx common plugins (Jenkins, TeamCity, Bamboo, etc.) enabling the ability to break the build in cases where a CxOSA Policy is violated.

When a build fails on OSA policy violations, the policy violations report displays the names of the libraries that violated the policy with the respective policy names & rules violated.

Two new parameters (Install Nuget and Python packages) have been added to this version of all Checkmarx common plugins (Jenkins, TeamCity, Bamboo, etc.) enabling the retrieval of all Nuget and Python dependencies before starting the OSA scan.

The Checkmarx plugin parameter text has also been updated from ‘Execute NPM and Bower install packages command before Scan’ to ‘Execute dependency managers "install packages" command before Scan’.

A textual change has been implemented to the status bar at the top of Checkmarx Report for all common plugins (Jenkins, TeamCity, Bamboo, etc.) in cases of a failed scan status. Instead of ‘Checkmarx Scan Failed’, a ‘Checkmarx scan found the following issues’ header is displayed with a summarized list of the found issues (e.g. 4 Policies Violated, Exceeded CxSAST Vulnerability Threshold).

For CxOSA, icons for libraries (“vulnerable & outdated libraries,” and “no known vulnerability libraries”) are removed from UI. Also, for libraries, the text “<number> Policy Violated Libraries” displays on the UI.

If the build failed on CxOSA policy violations, a new section in the report shows this data – the names of the libraries that violated the policy, along with their respective policy names and rules that were violated.

The node_modules" folder is now automatically added to the Folder Exclusion list as default for all common plugins (Jenkins, TeamCity, Bamboo, etc.) and for all new CxSAST installations (v8.9.0 and up). For CxSAST upgrade this setting will need to added manually.

Two new options (Install Nuget and Python packages) have been added to this version of the Checkmarx CLI plugin enabling the retrieval of all Nuget and Python dependencies before starting the OSA scan.

The existing CLI parameter has also been updated from ‘-executeNPMandBowerInstall’ to ‘-executepackagedependency’.

A new parameter (-CheckPolicy) has been added to this version of all Checkmarx CLI plugins enabling the ability to break the build in cases where a CxOSA Policy is violated.

When a build fails on an OSA policy violation, error code/exit code 18 (Policy is Violated) is flagged.

Federal Information Processing Standards (FIPS) Support

If findings (results) attributes changed during a review process (e.g. severity changed from High to Medium) a manual sync of the scan is required in order to view updated policy violations status in management and orchestration.

Links to management and orchestration policy violations dashboards require login credentials - planned to be resolved in next release.

If a Sync with policy management gets stuck in "syncing" mode for a certain project, a re-scan is required to release the state.

If a sync process fails, a manual sync action is needed to sync again using the sync button in the policy management tab in the projects section.

The following custom Jira field types are no longer supported:

• Select List (Cascading)
• Select List (Multiple choices)
• Number Field
• Epic Link