This article includes a list the new features and bug fixes that are included in Lucent Sky AVM 4.5, as well as known issues of this release.
For more information about this release, visit the blog post Lucent Sky AVM 4.5 released.
Updates in Lucent Sky AVM 4.5
-
Second-generation source code analysis engine - The second-generation source code analysis engine is an overhaul of the source code flow analysis engine and the contextual analysis engine. The second-generation engine analyzes over 12 times more source code information than the previous engine. This allows for greatly improved accuracy in source code analysis, contextual analysis and the resulting remediation. However, a temporary downside is that a typical scan will now take about 10-20% additional time to complete. We expect the performance to gradually improve over the next few releases.
-
Second-generation remediation engine - We redesigned Lucent Sky AVM's remediation engine to take advantage of the vast amount of information generated by the 2nd-generation remediation engine. Because the remediation engine has much more information to analyze and base on to remediate vulnerabilities, Instant Fixes should be available to more results and with higher confidence score. Additionally, the mitigation stage should take 15-20% less time due to algorithm improvements.
-
Migration to .NET Framework 4.7 and Win32 long path support - The server components of Lucent Sky AVM was migrated to .NET Framework 4.7. In addition to the performance and reliability improvements brought by .NET Framework 4.7, Lucent Sky AVM now supports Win32 long path (i.e. paths longer than 260 characters) when running on Windows Server 2016. To enable Win32 long path support on your Lucent Sky AVM servers, contact Lucent Sky support. You can also learn more about .NET Framework 4.6.2 and Win32 long path support at this excellent post by Microsoft's Jeremy Kuhne.
-
CLI and IDE plug-in updates - The CLI has been updated to support user management features. The Visual Studio extension and Eclipse plug-in also received updates related to server-side updates on v4.5.
-
Rule package update - Rule package for .NET, Android, iOS, Java, and PHP have been updated to support additional vulnerability types.
List of fixes included in Lucent Sky AVM 4.5
Scan created using the CLI does not inherit project file from its application
When creating a scan using the CLI, the scan does not inherit project file set in its application. This is due to a bug in the CLI, and affects versions between 4.0 and 4.3.
This issue has been resolved in Lucent Sky AVM 4.5.
Known issues of Lucent Sky AVM 4.5
Unable to upload source code archive containing files with long paths using the Web UI
When running Lucent Sky AVM 4.5 on a system that supports Win32 long paths, an error message about exceeding path length limit is shown and the upload cannot continue. This is due to the zip archive verifier in the Web UI unaware of the long path settings in Windows, and affects version 4.5.
A hotfix for this issue is available. If you are impacted by this issue, you can obtain the hotfix from Lucent Sky support. Also, this issue is expected to be resolved in Lucent Sky AVM 4.6.
Syntax highlighting does not work in HTML reports of some iOS apps
When opening an HTML report of an iOS app and at least one result contains Swift code, an error message about syntax highlighting is shown. Additionally, Swift code in the report is not highlighted. This is due to the syntax highlighter used by Swift is not packaged in the HTML report template, and affects version 4.5.
A hotfix for this issue is available. If you are impacted by this issue, you can obtain the hotfix from Lucent Sky support. Also, this issue is expected to be resolved in Lucent Sky AVM 4.6.