General Availability (GA) release details for the following:
DLP Extension 11.7.101 Hotfix
DLP Endpoint 11.6.401 Hotfix
DLP Extension 11.8.100
Reference DLPO-9436 to the DLP Endpoint Extensions section.
December 13, 2021
Added End of Life (EOL) status to DLP Discover 11.4.x and 11.3.x, and provided a link to the DLP EOL article.
November 18, 2021
Added:
DLP 11.8.0 release details, references DLPN-10971 and DLPN-10978 to the non-critical section, and SB10371 to the critical section.
DLP Discover 11.7.100 release details and reference DLPD-1082.
November 2, 2021
Added DLP Extension 11.7.100 resolved issues.
To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
Contents
Click to expand the section you want to view:
To view all available DLP General Availability (GA) release notes and other documentation, visit the Enterprise Product Documentation site.
For Release To Support (RTS) release notes, contact Technical Support.
McAfee Enterprise investigated this issue and a solution is currently available. This solution is currently not generally available, but is in Released to Support (RTS) status. To obtain the RTS build, log on to the ServicePortal and create a Service Request. Include this article number in the Problem Description field.
Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.
Issue: The SQL Injection vulnerability CVE-2021-4088
allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database.
Issue: The SQL Injection vulnerability CVE-2021-31849 gets triggered when deleting user information in DLP Endpoint for Windows.
-
11.0
11.6.400
Issue: The Cross Site Scripting (XSS) vulnerability CVE-2021-31848 in DLP Case Management.
Non-critical
Reference Number
Related Article
Found
In
Fixed
In
Issue Description
Resolved - non-critical (DLP Endpoint)
DLPW-5419
DLPW-6526
DLPW-7183
-
11.6.0
11.6.401
Issue: Multiple web incidents are triggered from Microsoft Edge and Chrome without URL information when opening the browser or while browsing.
DLPW-6154
-
11.6.0
11.6.401
Issue: An incident was caused for files downloaded using the Microsoft Edge.
DLPW-6279
-
11.6.0
11.6.401
Issue: Emails are blocked due to the email recipient detection.
DLPW-6948
-
11.6.0
11.6.401
Issue: Incidents are generated with no or unknown URL information.
DLPW-7229
-
11.6.0
11.6.401
Issue: Emails sent are held in Outbox for an hour after Windows Client Configuration is enabled. The Enabling Windows Client Configuration is followed by Email Protection, Outlook Background Processing, and Enable Background Processing.
DLPW-7243
-
11.6.0
11.6.401
Issue: Email gets held when 'Do not deliver before' option is checked.
DLPW-7303
-
11.6.0
11.6.401
Issue: A false positive issue occurs in DLP blocked PDF files, when opened in Microsoft Edge or Chrome browsers for viewing.
DLPW-7313
-
11.6.0
11.6.401
Issue: Windows Explorer crashes due to both printer handler probe, and copy file handler probe.
DLPW-7323
-
11.6.0
11.6.401
Issue: DLP incident Manager doesn't show other device information for CD or DVD devices that were copied to an external drive.
DLPW-7472
-
11.6.0
11.6.401
Issue: UCE DLP Ethernet or WiFi properties (NIC option) present in the network property couldn’t be edited.
DLPW-6950
-
11.6.0
11.6.400
Issue: Copy and paste operations from the remote system to the local system, fail to trigger incidents or notifications. You see this problem with DLP Endpoint on a remote and local system when the Clipboard Protection rule is blocked.
DLPW-6909
-
11.6.0
11.6.400
Issue: Blank dialog box after you click the three-dots (burger) menu. You see this issue after you select either of the following rules: 'Evidence Rule Name' and 'Evidence Rule Set Name'. The rules are found under Queries & Reports, New Query, Filter page.
DLPW-6411
-
11.6.0
11.6.400
Issue: The DLP Printer Protection rule doesn't block printing of text files from local Chromium-based browsers.
DLPW-7095
-
11.6.300
11.6.400
Issue: An open draft message in Outlook closes when you reply to another message.
DLPW-6968
-
11.6.200
11.6.400
Issue: Printing from a browser window (Chrome and Microsoft Edge) becomes unresponsive. The screen shows Not responding. This problem is still incurred after adding the processes (chrome.exe and msedge.exe) to the DLP exclusion list.
DLPW-6436
-
11.6.0
11.6.400
Issue: The CPU spikes on the process fcag.exe randomly to over 20% for more than 120 seconds.
DLPW-6070
-
11.6.0
11.6.400
Issue: Encrypted sent emails are held in the Outbox for an hour. You see this issue after you enable Windows Client Configuration, Email Protection, Outlook Background Processing, and Enable Background Processing.
DLPW-6069
-
11.4.200
11.6.400
Issue: You’re unable to install the DLP client. The error message below is displayed during the failed install: The module with the version of windows might not be compatible.
DLPW-6313
-
11.6.200
11.6.400
Issue: A DLP event generated from an endpoint with a Web Protection rule, shows incomplete URL information. You see this issue when the events are viewed from the Chrome browser.
DLPW-6160
-
11.6.200
11.6.400
Issue: No URL information displays when you generate an incident report.
DLPW-7130
-
11.5.970
11.6.400
Issue: The Microsoft Information Protection (MIP) label isn't detected (blocked) if the system booted outside VPN.
DLPW-6991
-
11.6.300
11.6.400
Issue: The DLP Endpoint 11.6.200 blocks file uploads to exempted URLs.
DLPW-6955
-
11.6.200
11.6.400
Issue: The destination URL isn’t displayed in the 'Destination' column of the Incident Manager. You see both in Chrome and Microsoft Edge browsers.
DLPW-6948
DLPW-6947
-
11.6.200
11.6.400
Issue: The DLP Incident Manager shows incidents destination (Matched URL and Web request URL) as "Not Available". You see this issue after you upgrade to DLP Endpoint 11.6.200.
DLPW-6534
-
11.6.100
11.6.400
Issue: The DLP incidents generated for file uploads show a different URL than the actual URL location of the file upload.
DLPW-6169
-
11.6.100
11.6.200
Issue: The DLP Agent service doesn’t start automatically after you install DLP Endpoint 11.6.100 on Windows 10 Version 19H1 32-bit systems.
Workaround: Update your systems with the latest Microsoft Security updates.
DLPO-7221
-
11.6.00
11.6.100
Issue: Configuration changes are made in the Client Configuration under the Email Protection tab and the policy is applied on the other tab. The client configuration still appears as “Pending Changes.” This issue occurs even though the changes are saved.
Workaround: Click Apply Policy on the same tab where the configuration is made, namely, the Email Protection tab.
DLPO-3333
-
11.4
11.6.100
Issue: The file size for the incidents reported by MVISION Cloud are displayed in the decimal point under DLP Incident Manager, Incident List.
DLPO-3353
-
11.4
11.6.0
Issue: The incident reported by MVISION Cloud doesn’t display the unique match count under "Evidence."
DLPO-3354
-
11.4
11.6.0
Issue: "SharePoint/OneDrive" incidents have 0.0.0.0 as the computer IP in the incidents reported by MVISION Cloud.
1271560
-
11.2
11.3.000
Issue: When DLP Endpoint is upgraded from 11.1.200 to 11.2, the upgrade fails.
Workaround: Uninstall DLP Endpoint 11.1.200 and restart the system before you upgrade to DLP Endpoint 11.2.
1264676
1265030
-
11.1.100
11.2.000
Issue: Test connection fails for Evidence Storage if the password contains special characters. (It appears in DLP Settings or on the Evidence Copy Service page of the Client Configuration.)
1264486
-
11.1.100
11.2.000
Issue: Files are allowed to be uploaded from all URLs even when the Application File Access Protection blocking rule is configured with specific URL exception list.
1261969
-
11.1.100
11.2.000
Issue: Links in the emails that DLP Case Management automatically generates don’t work.
1264467
-
11.1.100
11.2.000
Issue: Classification caption isn’t added in the sent emails.
1262607
-
11.1.100
11.2.000
Issue: If a sensitive file name contains non-English characters, the web protection rule doesn’t work when you use Chrome browser version 67 and later.
1222510
-
11.0.200
11.2.000
Issue: When the PDF image files are opened in the Internet Explorer, it displays the "There is a problem with Adobe Acrobat/Reader" error message.
1245376
11.0.500
11.1.0
Issue: False positive incidents occur when a Plug and Play device rule or a Removable Storage Device Rule:
Has a user condition with an OR operator between multiple condition lines.
And:
An exception is added with a user condition.
1253012
11.0.200
11.0.700
Issue: An error appears in the Windows 10 Event Viewer shows one or more of the following:
Faulting module name: fcagpph32.dll
Faulting module name: fcagpph64.dll
Faulting module name: fcagcbh32.dll
Faulting module name: fcagcbh64.dll
Workaround: Add the process name that appears in the event viewer error, to clipboard whitelisted processes in the Windows Client configuration.
1240128
11.0.400
11.0.500
Issue: Microsoft Office applications don’t respond when an Application File Access rule is set to block, or monitor a classified file. For example, Word, Excel, and PowerPoint. Resolution: Add Microsoft Office applications to the Content Tracking Whitelisted Processes in client configuration. Also, add the folder …\Program Files…\Microsoft Office\Office…\PROOF\ for all files.
10.0.300
11.0.130
Issue: After you upgrade Windows to Windows 10 RS 1 (Anniversary Update), MFE***.sys isn’t registered in the Registry under Safe Boot key. So, access protection and network communication protection rules don’t work in Safe Mode (minimal and network).
Workaround: Upgrade DLP or reinstall.
1034514
11.0.130
Issue: When the Run DLP client in Safe Mode configuration is disabled, log on in safe mode and return to normal mode. McAfee Agent sends an error report to ePO that Drivers initialization failed.
Workaround: To return the reporting to normal mode, restart client.
Issue: DLP Appliance Management extension reports incorrect CPU system use.
Workaround: See the related article for details.
DLPO-3242
-
11.4
-
Issue: An Email Protection Rule is created and an email is sent to more than two recipients. All email recipients aren’t displayed for MVISION Cloud. The email recipients are displayed when you hover over it.
Issue: From 11.6, DLP Endpoint supports web protection rules on Edge based on Chromium (Version 84.0.4147 and later).
In 11.6, DLP Endpoint doesn’t support URL-specific rules on Edge browsers for the following rules:
Clipboard protection rule
Printing protection rule
Application protection rule
Workaround: Configure the above-mentioned rules without URL-specific configuration. Use the “Any URL” option.
DLPO-3350
-
11.4
-
Issue: If the email doesn’t have a "Subject" added to it, the "Email Subject" under Additional Information displays "No Subject" with the angle brackets for MVISION Cloud.
DLPO-3404
-
11.4.0
-
Issue: If the shared location is Unavailable, evidences aren’t imported from MVISION Cloud to ePO. When the shared location is restored, evidences are recovered after 10 minutes by default.
DLPO-3012
-
11.3.0
-
Issue: DLP Web post aggregation fails in mail.google.com (Gmail). There’s no aggregation and multiple incidents are generated instead of a single incident.
DLPW-4540
-
11.3.0
-
Issue: When the Chrome Injection is disabled, and the rule is triggered, the Incident Manager on ePO displays the failure reason as:
“Non-Supported Chrome Version.”
DLPW-4100
-
11.4.200
-
Issue: The Windows 10 Microsoft Print to PDF built-in printer is considered a local printer by DLP Endpoint.
898377
9.3.100
-
Issue: Clipboard blocks copying from Microsoft Word to Microsoft Outlook. You see the error: Word has encountered a problem.
DLPX-42
9.3.0
-
Issue: Removable Storage Device Rule on OS X can't block writing to CD/DVD and can't set the CD/DVD to read-only rule.
DLPW-3350
-
Issue: The fixed hard disk rule doesn’t work for drives mounted in an NTFS folder.
DLPX-41
9.4.0
-
Issue: UAG configuration using LDAP Object Identification - Identify LDAP objects by their name isn’t supported for Mac clients. Workaround: Use LDAP Object Identification - Identify LDAP objects by SID (Security ID) configuration.
Known Issues - non-critical (DLP Endpoint)
979613
n/a
Issue: A blue screen error occurs after you create a Plug and Play device rule to block CD/DVD drives on a Windows 8.1 system with Roxio burning software. Resolution: Contact Roxio to have your issue investigated.
1012744
n/a
Issue: When Endpoint Encryption for Removable Media (EERM) initializes blocked devices, they aren’t treated as Content Encrypted by McAfee devices until the devices are removed and plugged in again. NOTE:There are no plans to resolve this issue. Implement the workaround below. Workaround: Remove the device and plug it in again.
872984
9.3.0
n/a
Issue: A Web Post rule blocks the metro user-interface application with the Internet Explorer handler. NOTE:There are no plans to resolve this issue.
914808
9.3.0
n/a
Issue: Some built-in USB SD card readers are physically connected to the USB bus and not to the SD bus. As a result, they’re recognized as a USB bus type and not as an SD bus type. NOTE:There are no plans to resolve this issue. Implement the workaround below. Workaround: Open the Mac System Information and determine if the SD card reader is connected to the USB bus or to the SD bus. If the SD card is connected to the USB bus type, configure your Removable Storage Device Rule to protect USB bus type.
907629
9.3.0
n/a
Issue: DLP Agent can't recognize a FAT32 file system on a GUID Partition Table formatted drive. NOTE:There are no plans to resolve this issue. Implement the workaround below. Workaround: To block a FAT file system, select both FAT16 and FAT32 as File System Type in the Removable Storage Device Rule.
Issue: DLP Endpoint 11.x doesn’t support Web Protection, Clipboard Protection, and Printing protection for Microsoft Edge version 42. Also, DLP Endpoint versions earlier than 11.0.200 don’t support Web Protection for Microsoft Edge version 40 and v41.
DLPW-3359
n/a
Issue: You open Microsoft Excel files from the shortcut menu on a client with Application File Access Protection. The Microsoft Office Applications condition is applied, and the Titus plug-in is installed for Microsoft Office. You see an error. NOTE:There are no plans to resolve this issue. Implement the workaround below. Workaround: Open the Excel application by going to File and then Open, or disable DDE for Excel application (on the registry).
945247
n/a
Issue: Printing protection rules don’t block Word-to-PDF conversions when the printing application is defined as Microsoft Word. This issue occurs because the application that performs the conversion isn’t Word, its Adobe Distiller. Resolution: Define the application as Adobe Distiller in the Application field.
875868
875981
-
-
n/a
Issue: If Microsoft Outlook isn’t the default mail client, Email Discovery doesn’t run and the console displays wrong values. NOTE: Outlook has always been a prerequisite and must be the default mail client.
982508
-
9.3.207
n/a
Issue: Clipboard Protection Rule triggers every time a user right-clicks on an Internet Explorer browser window with restricted data already copied to the clipboard. (No paste operation is performed.)
NOTE:There are no plans to resolve this issue. Implement the workaround below. Workaround: Add explorer.exe to the Clipboard allowed processes in client configuration.
-
-
-
n/a
Issue: The DXL client must be in the connected state for the Application file access protection rule,including TIE reputation condition to work. While DXL is in a disconnected state, the Application File access protection rule works based on the reputation cache, if it exists.
-
-
-
n/a
Issue: You must restart the DLP Client for the Email Protection rule to work on Lotus Notes.
n/a
Issue: Software that contains an application-level restriction mechanism, must be configured to permit all DLP Endpoint service requests. A restriction mechanism can be virus protection, antispyware, or personal firewall software. For example, for the DLP Endpoint Agent to start when Tenebril SpyCatcher is installed, you must add the agent as a trusted application in SpyCatcher.
-
-
-
n/a
Issue: The Block and charge feature is supported only for iPhone 4 and later. There’s no workaround. Earlier iPhones can only be blocked.
-
11.6
n/a
Issue: When Outlook background processing is enabled and a user tries to send a non-mail Outlook item, DLP agent processes the item in a foreground mode. (Examples of a non-mail Outlook item are an invite or creating a task.)
DLP agent uses the timeout value configured in Windows Client Configuration, Client Config Name, Email Protection, Email Timeout Strategy, Email analysis maximum time (sec).
It also uses the action to perform value configured in Windows Client Configuration, Client Config Name, Email Protection, Outlook Background Processing (Only for DLP 11.6 and later) Action if the maximum time exceeds.
-
11.6
n/a
Issue: If a registered document has multiple classifications attached to it, you can't delete a single classification from the registered document.
Information: It prevents the user from deleting a classification that has a registered document attached to it.
Workaround:
Delete the registered document.
Delete the classification that you don’t want.
Upload the registered document with other classifications attached to it.
n/a
Issue: DLP Endpoint doesn’t interact with IPv6. The Data Loss Prevention IP features don’t support it or interfere with it.
n/a
Issue: Incorrect configuration of the device blocking feature might cause the client computer to malfunction. For example, even though critical devices are normally in the unmanaged devices list, they can be moved to the managed list. We recommend that you test the device blocking rules on a subset of computers before mass deployment.
n/a
Issue: Tagging an application as an Internet Explorer application means that the DLP Endpoint Agent disregards any content manipulation by the application. Copy and paste, print screen, and content-based tagging rules don’t apply. Use the Explorer Strategy only for 'Explorer-like'.applications, such as shell applications.
n/a
Issue: To avoid performance issues, we recommend the following configuration changes:
Add all virus protection, indexing services, Windows update, and other trusted applications to the DLP Endpoint Policy Manager. Add them as an application group with the Trusted strategy.
Remove unnecessary applications and application groups from the DLP Endpoint Policy Manager.
n/a
Issue: When you disable device blocking, the change only takes effect after you restart the agent computer. Disabling the device blocking probe from the DLP Endpoint Agent configuration doesn’t unblock devices on the agent computer. Devices that were in a blocked state before disabling the device blocking probe remain in the blocked state until unplugged and plugged in again. IMPORTANT:Perform removal of device blocking in emergency cases only. A restart re-enables the devices that were blocked.
To achieve the effect of unblocking a specific device class, we recommend that you change the device class to unmanaged.
n/a
Issue: Screenshots and clipboard rules ignore the Trusted strategy and block Trusted applications as well as Editors. This behavior is expected because trusted processes aren’t part of the screen capture/clipboard logic.
n/a
Issue: Print Screen blocking rules remain in effect as long as the process that they’re tracking is running. Window focus doesn’t affect Print Screen blocking rules. This behavior is expected because a sensitive file that isn’t in focus can still be visible on the screen.
n/a
Issue: The network communication protection blocking rule doesn’t block or monitor SMB connections. The reason is because these connections are covered by file system rules.
-
-
11.3.0
n/a
Issue: In the Chrome Incognito mode, the Chrome extensions aren’t available, so the URLs aren’t detected. So, the allow list URLs and URL exceptions aren’t being applicable in the Incognito mode.
-
-
-
n/a
Issue: In the Removable Storage File Access Device rule, there’s an Or condition between the file extension and the True File type. For example, if you define a rule to block the file extension exe and True File: HTML, both file types are blocked.
-
-
-
n/a
Issue: You can't upgrade DLP Endpoint while the Sysinternals Process Explorer tool is open. If you experience an issue when you upgrade DLP Endpoint, make sure that this tool is closed.
-
-
-
n/a
Issue: When you upload registered documents, if you try to upload a file with a file name longer than 50 characters, it fails with an error message. The problem occurs because Windows file path has a 256-character limit. DLP Endpoint concatenates the internal path to the file name, which can result in paths longer than the allowed limit. Resolution: Shorten the file name to fewer than 50 characters.
n/a
Issue: Network Communication protection rule and Screen Capture protection rule don’t support Manual Classification.
-
-
-
n/a
Issue: To reduce memory consumption, the total number of dictionary items that can be used in a policy is limited to 50,000.
-
-
-
n/a
Issue: To reduce memory and CPU use, the total number of signatures contained in the registered documents package is limited to 1,000,000 signatures. This number is that maximum that can be placed in a registered document repository. This number is equivalent to about 250 MB of original document content.
461535
Expected Behavior
Issue: Email protection rules are bypassed when the network connection is disabled and Lotus Notes is set to Offline mode.
348500
Expected Behavior
Issue: When you plug a Kingston U3 drive into a computer with a mass storage device, the tagging rule causes high CPU use for several minutes. The reason is because of large *.u3pfiles being opened on the drive. Workaround: Add Launchpad.exeto an application group and set the strategy to Trusted.
Issue: Remote Code Execution (RCE) vulnerability CVE-2021-31845 in DLP Discover that parses Ami Pro (.sam) files during server content inspection.
Non-critical
Data Loss Prevention Discover (Non-Critical)
Reference Number
Related Article
Found
In
Fixed In
Issue Description
Resolved - non-critical (DLP Discover)
DLPD-995
-
11.5.0
11.7.0
Issue: DLP Discover remediation scans with large number of Exact Data Matching (EDM) matching values now take shorter duration because of the improved performance in EDM algorithm.
1268509
-
11.1.100
11.2.0
Issue: DLP Server is unable to synchronize "RegDocs" packages from the evidence share and shows access denied for local system account user. Workaround: Grant permissions (at least Read rights) to the DLP Server’s local system account user to access the evidence share.
Investigating - non-critical (DLP Discover)
1264942
-
11.1.100
-
Issue: The DLP Discover OCR module's rate of accuracy when it extracts some Asian languages is inconsistent.
DLPD-820
-
-
Issue: The messageFailure reason: General erroris incorrectly displayed when user permission is insufficient to access a site.
DLPW-3361
9.4.0
-
Issue: Endpoint Discovery scheduler with Time Zone Coordinated Universal Time (UTC) on and running McAfee Agent (MA) 5.0.1 runs as Local time on managed systems. Workaround: Use Local time zone on managed systems instead of Coordinated Universal Time (UTC) when using MA 5.0.1.
DLPD-1206
-
11.6.0
-
Issue: The Discover server installation doesn’t install the prerequisite software such as SharePoint client or Active Directory rights management when you install with the Advance deployment option in on-premises or MVISION ePO.
Known Issues - non-critical (DLP Discover)
1143438
-
-
n/a
Issue: The DOCREADME BOX, 'redirect URI in box app' needs to be the same as the ePO web address.
1090520
-
-
n/a
Issue: You see the Restore from file option, but, when you click it nothing happens. NOTE:There are no plans to resolve this issue. Implement the workaround below. Workaround: Click Browse, browse to the backup file, click Restore from file, and then click Save.
1136118
-
Expected
Behavior
Issue: DLP Discover isn’t reported as reporting product in Incident Manager.
1121738
-
Expected
Behavior
Issue: Apply RMS fails when user profile isn’t loaded correctly.
Issue: User group field isn’t populated in Queries & Reports but shows up in Incident Manager.
1204331
10.0.101
11.0.200
Issue: DLP Prevent can't upload to evidence server which has SMBv1 disabled.
1205892
10.0.203
11.0.200
Issue: DLP Prevent 10 generates several incidents for one violation.
1206520
11.0.0
11.0.200
Issue: Processing of large DLP Prevent/Monitor policy configurations takes an excessively long amount of time to apply.
1206927
10.0.200
11.0.200
Issue: No SNMP traps generated for "Data Loss Prevented" objects.
1207482
10.0.101
11.0.200
Issue: An Outlook related issue causes .eml files to render incorrectly from the evidence page.
1199994
11.0.0
11.0.200
Issue: DLP Prevent doesn’t trigger a rule based on the classification using "Count each match string only one time".
1205024
10.0.203
11.0.200
Issue: DLP Prevent can't detect custom properties of a .PDF file.
1211093
10.0.204
11.0.200
Issue: Internal rescue image doesn’t update to the new build.
1213643
11.0.0
11.0.200
Issue: OPG2CSF.xsl doesn't ignore the obsolete true file type condition "Password protected files".
1215265
11.0.0
11.0.200
Issue: Messages with multiple recipients aren’t delivered to all recipients.
Investigating - non-critical (DLP Prevent and Monitor)
TSDP-3727, TSDP-3912, TSDP-24
-
11.4.0
-
Issue: In the ePO, the Appliance Management page shows "Unable to contact" alert for one or more DLP Prevent or DLP Monitor appliances.
Cause: The appliance is unable to contact ePO due to communication breakdown between MCA and MA on the appliance. The deadlock within MCA causes the breakdown.
Workaround: Restart the MCA process every hour so that any deadlock is automatically removed without the need of manual intervention or reboot. For workaround installation details, contact Technical Support.
Known Issues - non-critical (DLP Prevent and Monitor)
DLPO-5104
-
11.5.0 (RTS)
n/a
Issue: The document registration scan fails when the DLP Server is upgraded from an earlier version to 11.5, or with a fresh installation of 11.5.
IMPORTANT: Configuration changes might be needed for automatic document registration to work with the DLP Server 11.5.0.32.
Workaround:
The DLP Server's host account needs read access to the CIFS share on which the evidence files are stored. To provide the host account with read access to the CIFS share:
In the Choose people on your network to share with dialog box, add the host name of the system on which the DLP Server is running. Include a $ sign at the end of the host name.
For example, if dlpserver.your.domain is the FQDN of the host on which the DLP Server is running, add the host name as dlpserver$.
-
-
-
n/a
Issue: Multiple application-access events can be listed in the DLP Endpoint monitor. For some applications, such as Microsoft Word, more than one message is generated for a single application access. The reason is because of the application background procedures.
Issue: The SQL Injection vulnerability CVE-2021-4088 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database.
Issue: A Cross Site Scripting (XSS) vulnerability CVE-2021-31848 applicable to the DLP Management extension.
-
11.1.0
11.7.100
11.400
Issue:The SQL Injection vulnerability CVE-2021-31849 that gets triggered when deleting user information applicable to DLP Endpoint for Windows.
1257017
11.1.0
11.1.0.24
Issue: An attempt to restore a DLP 9.4 backup that includes classification criteria which looks for True File Type equals Password Protected files fails. The failure occurs when the DLP ePO Extension uses a DLP Prevent license or a DLP Monitor license. The failure also occurs if the DLP Skyhigh connection is enabled.
Workaround: Restore the DLP backup into a DLP ePO extension that doesn’t contain the licenses mentioned. Also, replace the classification criteria that checks for 'True File Type equals Password Protected files'. Set the criteria to look for a File Encryption type equal to Unsupported Encryption types or password protected files. If the classification criteria has been modified, create a DLP backup.
Issue: The incidents aren’t being imported from MVISION Cloud to DLP Incident Manager.
Non-critical
Data Loss Prevention Management Extension
Reference Number
Related Article
Found
In
Resolved In
Issue Description
Resolved - no-critical (DLP Management Extension)
DLPO-9467
-
11.6.100
11.8.100
Issue: An error occurred when you try to create a drive or device group from the DLP Policy Manager, under Definitions, Device Templates, Actions, and New Group.
DLPO-9339
-
11.6.100
11.8.100
Issue: Logging into ePO console and navigating to certain pages took longer for non-administrative user accounts.
DLPO-8860
-
11.6.100
11.7.101
11.8.100
Issue: The queries cause transaction logs to grow which creates performance issues.
DLPO-8991
-
11.6.100
11.7.101 11.8.100
Issue: A network shared folder for a classification couldn’t be created with only the server name and, without a mandatory folder name.
DLPO-9291
-
11.6.200
11.7.101
Issue: The File System Type property value is considered as default even if the parameters have predefined values.
DLPO-9353
-
11.6.200
11.7.101
Issue: The default whitelisting for Microsoft Edge in Content tracking are missing.
DLPO-9356
-
11.6.100
11.7.101
Issue: In the DLP policy changes, Save Agent Policy information is written with an administrative user in the Audit Log, rather than the logged in user.
Issue: After you upgrade ePO 5.10 Update 10, the drill-down data tables are blank in the DLP incident reports. Seen when you export to CSV or PDF formats.
DLPO-8860
-
11.3.0
11.7.100
11.6.040
Issue: DLP Endpoint queries cause the ePO Transaction log database to grow, which results in performance issues.
DLPO-9182
-
11.6.0
11.7.100 11.6.040
Issue: Incidents for offline processed events don't show the correct status in the Actual Action column on the Incident Manager page.
DLPO-8659
-
11.6.100
11.7.100 11.6.040
Issue: After you upgrade to ePO 5.10.0 Update 10, with the Japanese and Traditional Chinese versions of DLP Endpoint 11.6.100, the page doesn't load. You see this issue on the Email Protection page of the Windows Client configuration policy. This issue has been seen as loading continuously on all supported browsers, but the page never loads.
DLPO-8186
-
11.6.0
11.7.100 11.6.040
Issue: When you run the DLP Import 'MVISION Cloud Events Task', it takes two hours to complete. You can specify the number of incidents that can be imported from the MVISION Cloud Server page in a server task. The default value is set to 1000. The issue is seen when setting a value lower than 1000.
DLPO-8185
11.6.0
11.7.100 11.6.040
Issue: After you run DLP Import 'Pull incidents from MVISION Cloud', the task fails intermittently. The Classification name also shows as 'None'. You see this issue after you enable the task from the MVISION Cloud Server DLP Settings page.
DLPO-9184
11.5.0
11.7.100 11.6.040
Issue: The CC and BCC domains for MVISION Cloud incidents weren’t shown in the Destination column of the DLP Incident Manager, and the Incident History tab.
Issue: “An unexpected error occurred” is displayed when accessing the DLP Settings page. The Issue is seen on ePO 5.10 Update 11 systems.
1246454
11.0.500
-
Issue: Incidents contain "Short Match String" even when Report Short Match String is disabled in the policy settings.
1066784
-
-
-
Issue: Queries and Reports: Incident count displays an incorrect value for DLP: No of incidents per rule set if multiple rules hit the same file on a rule set.
1034291
-
-
-
Issue: Reoccurring quarantined placeholder events generate an error when you try to open them through open this occurrence.
Workaround: The option open this series doesn’t display the error. Also, after the events are released from quarantine, the error no longer appears.
DLPO-3029
-
11.3.0
-
Issue: Redacted data is visible when the DLP incidents are displayed in a report.
Workaround: For the redacted users, deny permissions to Queries and report.
-
-
-
-
Issue: The write permissions set for the allow list folder are incorrectly enabled for more than the DLP administrator.
Known Issues - non-critical (DLP Management Extension)
-
-
-
n/a
Issue: The DLP Endpoint 10.x Management Extension might fail to install if the DLP 9.3.x help extension is already checked in.
Workaround: Only one help extension can be checked in at one time. You must remove the DLP 9.3.x help extension to install the DLP Endpoint 10.x help extension.
-
-
-
n/a
Issue: When you upload registered documents, if you try to upload a file with a file name longer than 50 characters, it fails with an error message. The problem occurs because Windows file path has a 256-character limit. DLP Endpoint concatenates the internal path to the file name, which can result in paths longer than the allowed limit.
Resolution: Shorten the file name to fewer than 50 characters.
-
9.4.0
-
n/a
Issue: After you import DLP Endpoint 9.4 MAC Policy to DLP Endpoint 10.0, you must reassign the MAC policies and MAC configuration to its System Tree nodes in the new environment. You must also make these reassignments after you upgrade from DLP Endpoint 9.4 to DLP Endpoint 10.0.
-
-
-
n/a
Issue: When you restore a policy that includes the Prevent action Encrypt by FRP, you must reselect the key.
-
-
-
n/a
Issue: You must add both conhost.exe, and dllhost.exe to the 'Application file process access allow list'. Complete the task once you’ve updated the DLP Endpoint extension. The list is contained within the client configuration section.
-
-
-
n/a
Issue: DLP Email Protection is disabled if Titus Email Classification is used and the Titus license expires.
Workaround: Deselect the Titus support checkbox in the Advanced Configuration tab in the Agent configuration.
-
-
-
n/a
Issue: After you import DLP Endpoint 9.4 MAC Policy to DLP Endpoint 10.0, you must reassign the MAC policies and MAC configuration to its System Tree nodes in the new environment. You must also make these reassignments after you upgrade from DLP Endpoint 9.4 to DLP Endpoint 10.0.
