Releases of September 2022
New features and improvements
Status | Description |
|---|---|
Release of September 18 | |
NEW | To help users diagnose the found vulnerabilities, remediation advice provided by the Checkmarx Application Security team is now displayed in all the IDEs (Integrated Development Environment). The following additional information will now be displayed where applicable: risk cause, general recommendations, and a code sample. |
NEW | In addition to Bitbucket Cloud, Checkmarx One now supports Bitbucket self-hosted on-premise servers. |
NEW | SCA risk details displayed in the IDE have been enriched and expanded. They now include a more detailed description and provide the ability to automatically fix in the coder the relevant updated version. |
Release of September 11 | |
NEW | Users are now able to obtain the direct link to a specific vulnerability in a scan. This link can then be shared with other users who will follow it to open the same view showing the target vulnerability. |
NEW | The KICS engine has been upgraded to version 1.5.10 to improve its performance, accuracy, and stability. |
Release of September 4 | |
NEW | AppSec Knowledge Center now supports all engines as a single source of data for vulnerability cause explanation and remediation. |
NEW | A new Checkmarx One environment for APAC region has been deployed in Singapore at https://sng.ast.checkmarx.net |
NEW | To simplify and accelerate the triage of a large number of vulnerabilities, issue severity and state can now be updated in bulk. |
NEW | The representation of SCA risk details in IDE has been enhanced to allow for faster and more accurate remediation of SCA findings. |
NEW | New flow for optimizations ordering has been implemented. |
NEW | The SAST engine has been upgraded to version 9.5 to improve its performance, accuracy, and stability. |
NEW | The creation, update and closing of issues within ADO Work Items are now done automatically. This is useful for customers who use ADO as a bug tracker. |
NEW | To help users diagnose the found vulnerabilities, remediation advice provided by the Checkmarx Application Security team can now be retrieved via CLI. The following additional information will now be displayed where applicable: risk cause, general recommendations, and a code sample. |
NEW | Auto-remediation has been implemented in KICS to enable automatic resolution of issues found during a scan. |
NEW | The data from the Applications and Projects table can now be exported in CSV format. |
CLI and Plugins Release of September 2022
During September, we released new versions of the CLI, containing important updates and improvements. We also released new plugin versions, containing additional improvements.
New CLI Versions
Version 2.0.28
Improvements and Bug Fixes
Status | Item | Description |
|---|---|---|
NEW | --resubmit flag | We added the TipWhen an argument in the current scan differs from the configuration of the previous scan, the argument in the current scan takes precedence. |
FIXED | SCA results | Fixed issues with SCA results handling. |
FIXED | Dangling links | Dangling symbolic links no longer cause the scan to fail. Now a warning is returned. |
Version 2.0.27
Improvements and Bug Fixes
Status | Item | Description |
|---|---|---|
FIXED | API key | Fixed issue handling errors when extracting credentials from an API key. |
CI/CD Plugins
In September we released the following CI/CD plugin versions.
Improvements and Bug Fixes
Status | Item | Platform | Description |
|---|---|---|---|
NEW | Pull request decoration | GitHub Action | The comments for pull requests are now decorated with results from Checkmarx One scans that were triggered by that pull request. The comments show a list of new vulnerabilities introduced by the code change as well as the vulnerabilities that were fixed. |
UPDATED | Job summary | GitHub Action | Added a Job Summary with the scan ID to the GitHub Action. |
UPDATED | Documentation links | Azure, GitHub Action | All documentation links now point to the new Checkmarx documentation portal at https://checkmarx.com/resource/documentation. |
IDE Plugins
In September we released the following IDE plugin versions:
Improvements and Bug Fixes
Status | Item | Platform | Description |
|---|---|---|---|
NEW | SAST results | VS Code, JetBrains | In the SAST results viewer, we added new tabs with additional info about each vulnerability.
|
NEW | SCA results viewer | VS Code, JetBrains | In the SCA results viewer -
|
UPDATED | KICS notification | VS Code | A notification is now shown in the Output section when KICS Auto-Scanning identifies an IaC vulnerability for which Checkmarx offers a suggested "quick-fix". |
UPDATED | Adding comments | VS Code | It is now possible to add a comment to a vulnerability without changing the state or severity of the vulnerability. |
UPDATED | Documentation links | VS Code | All documentation links now point to the new Checkmarx documentation portal at https://checkmarx.com/resource/documentation. |