3.1.1

April 2022

Key Updates

• The Black Duck Remote Provider Integration has been enhanced allowing multiple users to select the option to import applications by Application or Application Version

• Contrast Remote Provider enhancements

  • Enhancement when importing vulnerabilities to include Contrast Finding comments

  • Addition of support for OSS Dependency Findings imports to Contrast scans

  • Additional Contrast Statuses have been provided for mapping by ThreadFix

• Addition of Scan Orchestration option to Acunetix 360 Remote Provider

• Fortify SCC enhancements

  • Now allows importing Sonatype SCA vulnerability data

  • Support added for flexible tag definitions

• The AppScan on Cloud integration has been updated to allow importing applications that have scans but do not have vulnerabilities

• Added support for GitHub Dependabot (Beta) Remote Provider

New/Updated API

• New versionName and versionNativeId API calls for Black Duck Remote Provider, allowing users to import scans from multiple versions of a project at once

• New Fetch Applications and Get Scans API calls for Contrast Remote Provider

• The Get Application by Name and Get Application in a Team by Unique ID calls have been merged into Get Application by Name or Unique ID

• The Create Application and Update Application REST calls have been updated to include additional fields

General Improvements

• Remote providers can now also be instantly managed via drop-down menu from the Remote Provider list page

  

• CVSS scores now available as part of Finding Details

  

• General UI improvements

• General bug fixes and improvements

Feature Changes

Note the following changes to features with the introduction of ThreadFix 3.1.1:

Reintroduced

• The Check Remote Provider Application Import Status endpoint has been reintroduced

• Coverity Remote Provider has been reintroduced

Deprecated and Removed

For other REST API updates, refer to the Change Log

• The Black Duck call "/remediating" has been deprecated by Black Duck in version 2021.10.0 and has been replaced by "/upgrade"

• The SSVL Converter Tool deprecated in 3.1 has been removed

3.1

October 2021

Key Updates

• Fundamental and holistic rebuild of the ThreadFix architecture and deployment environment (please see the new environment requirements). To install a helm chart offline see the manual helm download.

• Full rewrite of our scan ingestion and processing logic to provide over 60x reduction in raw scan data processing speed

• Introduction of Remote Provider UI display cards and associated API

• Remote provider import and scan ingestion statuses display on the Scan Queue page

• Updates to the Scan Import Queue’s UI tooltips

• Update to add a new Queue Management permissions level

New/Updated API

• New GET ThreadFix application assets by import request ID API

• New GET Remote Provider Import Requests API

• New Pending Scan Status API

• New Scan Queue Management report view API

• Update to Remote Provider Import Request API

General Improvements

• Improvements to user login session management

• Leveraged new architecture to implement self-recovery for scan ingestion

• Improvements to Manual Vulnerability Actions

• Security improvements

• Bug fixes

Feature Changes

Note the following changes to features with the introduction of ThreadFix 3.1:

Deprecated and Removed

• Support has been ended for the SSVL Converter

• Bi-directional capability for Checkmarx and AppSpider has been removed

• Service Delivery/Service Request feature set is no longer supported

• Removed the Import All Vulnerabilities remote provider option

• Saved scan files on the file system will not be migrated to 3.1 (NOTE: this only impacts the raw scan files. All vulnerability data is fully retained and migrated)

• SonarQube Plugin removed from the Tools section.  Remote Provider integration still behaves as before.

• Support for the following integrations has been removed:

  • SkipFish

  • Swamp Scarf

Limitations, Scheduled for Enhancement Post 3.1

• Limit of 3000 vulnerabilities when exporting Vulnerability Search data to a .csv file.

• Remediation filters do not update automatically in 3.1, they will update with a defect status call sync. This feature is planned to be reintroduced. (NOTE: this may impact created policies based on these filters)

Absent, Scheduled for Re-introduction Post 3.1 

• The Disable Vulnerability Merging option when creating a new application has been removed, this feature is planned to be reintroduced

• Scan File Retention feature has been removed, this feature is planned to be reintroduced

• The Vulnerability Close Settings option, allowing users to close vulnerabilities only when all scanners report them closed, has been removed, but is planned to be reintroduced

• The Scan Agent tool API endpoints have not been migrated, this feature is planned to be reintroduced

• The ability to cancel queued scans has been removed, this feature is planned to be reintroduced in the future

• Time to Remediate Date policy override has been disabled, this feature will be reinstated

• Dashboard and Analytics page report caching time configuration has been disabled with plans to be re-enabled

• The Global FPR Filter Set API REST calls have been removed, with plans to be reintroduced

• Support for the following integrations has been removed, with plans for reintroduction:

  • Acunetix File Importer

  • Brakeman

  • Coverity

  • Dependency Check

  • Sonatype

3.0.8

March 2021

Security Updates

• Remediated identified access control vulnerabilities

Key Updates

• Issue fix for Qualys scan imports

• Docker Logging improvement

• Fix for Netsparker upload issue

• Bug fix for SonarQube

• Improved import ingestion and configuration options for InsightVM

• Support added for JAVA_OPTIONS modifications

• Issue resolution for QualysWAS findings scan profiles and findings merging error

• Comprehensive Time zone management updates in ThreadFix

• Fortify on Demand no longer imports Fixed or Suppressed findings

• Introduced support for Acunetix 360 Remote Provider and Acunetix Premium exports

• Improvement to the Jenkins plugin

• Added CVSS Score and Vulnerability IDs as dynamic Defect Tracker profile values

• Checkmarx Remote Provider microservice mapping performance improvement

• Vulnerability statuses are now mutually exclusive

• WhiteHat mobile data support

• Checkmarx enhanced finding tracking

• Portfolio page now reflects ThreadFix Pen Tests as Assessments

• WebInspect findings details expanded

• Portfolio Application View pagination

• Most Vulnerable Applications report grouping

• Significant performance improvements to the Team delete function

• Time to Remediate Policies now allow for per-vulnerability exceptions

• Veracode Remote Provider import includes SCA data

• NowSecure Remote Provider integration

General Improvements

• Improvements to UI-Page navigation

• Adjustment for improving scan data imports

• Improvement to Veracode Remote Provider scan updates

• API performance improvements

• Vulnerability Trending report improvements

• Portfolio UI improvements for large-scale deployments

• UI performance enhancements

• Bug fix for graphs displayed on PDF exports

• Filter on mobile vulnerability data

• Improved error messaging

• WhiteHat integration respects the Out of Scope status

• LDAP login supports additional user attributes

• Netsparker Enterprise enhancements

• Time to Remediate notification improvements

• File attachment usability improvements

• Updated 3rd party dependencies and other security improvements

• Other enhancements and bug fixes

• General performance improvements

Installation and Upgrade Guides:

• ThreadFix Installation Guides

• ThreadFix 3.x to 3.x Ubuntu Upgrade (Docker)

• ThreadFix 3.x to 3.x Centos Upgrade (Docker)

• ThreadFix 3.x to 3.x Upgrade (Kubernetes)

3.0.7

October 2020

General Improvements

• Expanded SAML support to cover additional use cases. As of 3.0.7 SAML is fully configurable in the UI from the Settings page.

• Resolved issues in Checkmarx and SonarQube integrations

• Performance improvements

• Other enhancements and bug fixes

Key Updates

• Vulnerability statuses are now mutually exclusive

• WhiteHat mobile data support

• Checkmarx enhanced finding tracking

• Portfolio page now reflects ThreadFix Pen Tests as Assessments

• WebInspect findings details expanded

• Portfolio Application View pagination

• Most Vulnerable Applications report grouping

• Significant performance improvements to the Team delete function

• Time to Remediate Policies now allow for per-vulnerability exceptions

• Veracode Remote Provider import includes SCA data

• NowSecure Remote Provider integration

General Improvements

• Filter on mobile vulnerability data

• Improved error messaging

• WhiteHat integration respects the Out of Scope status

• LDAP login supports additional user attributes

• Netsparker Enterprise enhancements

• Time to Remediate notification improvements

• File attachment usability improvements

• Updated 3rd party dependencies and other security improvements

• Added OAuth support for Jira Defect Tracker integration

• Improved parsing of scan data from AppScan Enterprise and Fortify SSC