Release 9.2.38.1¶

Updated Apache Solr Dependencies¶

Upgraded Apache Solr dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Apache Zookeeper Dependencies¶

Upgraded Apache Zookeeper dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

MSSQL Connector — Support for Special Characters in Object Names¶

SQL Server permits special characters in schema, table, and column names (for example, a table named 'Employees_2018-05-31_0$'). These names previously broke lookup queries: a single quote ended the SQL string literal early (Incorrect syntax near ...), and _ was treated as a LIKE wildcard so masks or row filters could be attributed to the wrong object. Object names are now escaped in query literals, and masking and row-filter lookups use an equality match. No configuration change is required.

MSSQL Connector — Conditional Custom Masking Prefix, Suffix, and Range Expressions Preserved¶

When a custom masking policy was evaluated for a condition, the prefix, suffix, and minimum/maximum value expressions were dropped, so the mask applied at the data source did not match the policy as authored. The full mask definition is now preserved during conditional evaluation.

MSSQL Connector — Microsoft Purview Tag Sync Reliability on Large Catalogs¶

Tag sync against large or throttled Microsoft Purview accounts could stall or fail on slow API responses. This release includes:

• Configurable HTTP client timeouts and retries, so tag sync can ride out a slow window instead of timing out. Controlled by CONNECTOR_PURVIEW_CLIENT_READ_TIMEOUT_SEC (default: 60), CONNECTOR_PURVIEW_CLIENT_RESPONSE_TIMEOUT_SEC (default: 60), CONNECTOR_PURVIEW_CLIENT_CONNECT_TIMEOUT_SEC (default: 10), and CONNECTOR_PURVIEW_CLIENT_MAX_RETRIES (default: 3). Raise the read and response timeouts together.
• The Purview HTTP client is now created once and reused across tag-sync cycles, instead of being rebuilt each cycle.
• Relationship subtrees are no longer fetched for entity types that cannot have them.
• Purview calls that exceed an expected duration are now logged as warnings.

MSSQL Connector — Optional Resource Name Validation¶

An optional, per-connector check can now skip resources whose names contain characters the data source or metadata store cannot represent, instead of allowing them to fail later in the sync. Validation is disabled by default. To enable it, set CONNECTOR_RESOURCE_NAME_ALLOWED_SPECIAL_CHARACTERS to the extra characters to allow in addition to a-z A-Z 0-9 _ (for example, /.$-). List characters with no separator; escape a literal comma as \,. Skipped resources are reported and the sync continues.

MSSQL Connector — Improved Retry Behavior for Data Source API Calls¶

Failed HTTP requests to a data source or catalog API were retried regardless of the reason for failure, so permanent errors such as 401 Unauthorized or 404 Not Found were retried repeatedly before failing. Client errors now fail immediately, except 429 Too Many Requests and 408 Request Timeout, which continue to be retried with backoff. Server errors continue to be retried. Failure logs now include the request and response bodies (truncated).

AWS Lake Formation Connector — Optimize Wildcard Table Grants¶

The AWS Lake Formation connector now uses a single Table grant with TableWildcard when a policy grants access to all tables in a database (table=*). This reduces the number of Lake Formation grants and API calls, speeding up policy synchronization for databases with many tables.

Security Zone Name in PolicySync Apply Logs¶

Added ZoneName support in PolicySync audits and apply logs for MSSQL, PostgreSQL, Redshift, Databricks SQL Analytics, and AWS Lake Formation connectors. ZoneName is shown for zoned policies and left empty for unzoned policies.

Bounded policy-sync.out to Prevent Unbounded Disk Growth¶

Bounded the policy-sync.out console log file to prevent unlimited growth and disk exhaustion (default: 50 MB), the size can be configurable through CONNECTOR_POLICY_SYNC_OUT_MAX_SIZE.

Updated PolicySync Dependencies¶

Upgraded PolicySync dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Connectors:

• AWS Lake Formation
• GCP BigQuery
• MSSQL

Download error logs for terminated pods from the Diagnostics Tool¶

• Download Logs now works for terminated pods, exporting from the error_logs table in the database.
• Only ERROR, WARNING and FATAL log lines are captured, so not all logs will be downloaded.
• The lookback window is set by DIAG_SERVER_TERMINATED_ERROR_LOGS_DOWNLOAD_WINDOW_DAYS (default 4 days). It is capped at the error log retention period (default 7 days), since older logs have already been purged — to go beyond 7 days, raise retention too.

Base Image Upgraded¶

Updated the base image to a newer Debian version to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

k9s available at /tools/k9s in the PM base image¶

The Privacera Manager base image now provides a k9s symlink at /tools/k9s, so the jumphost and tooling that expect that path can invoke k9s without relying on PATH alone.

Updated Grafana Image¶

Upgraded Grafana dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Prometheus Image¶

Upgraded Prometheus dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Opentelemetry-collector Image¶

Upgraded Opentelemetry-collector dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.

Updated Post Install Job Image¶

Upgraded Post Install Job dependencies to address known security vulnerabilities identified in the CVE (Common Vulnerabilities and Exposures) report.