Release Notes Patch (Version 2.13)

Tanium Patch 2.13.41.0000

Release Date: 8 December 2020

New Features

• Added GPGCheck and Repo GPGCheck configuration options to Yum Repositories, and began enforcing these configurations where applicable.

Improvements

• Changed MakeCache Fast to True for Linux patch scans.
• Removed the `--skip-broken' parameter from all Linux patch deployments.

Resolved Issues

• Fixed an issue that caused excessive WU_E_PT_ENDPOINT_UNREACHABLE Windows Update errors.
• Fixed an issue that was re-applying a Random Scan Delay to every Deployment retry attempt.
• Fixed an issue that caused Out of Memory Windows Update errors.
• Fixed an issue that caused WU_E_INVALID_CRITERIA Windows Update errors.
• Fixed a reporting issue that could cause Deployment Status to revert to "Not Applicable" after patches had been successfully installed.
• Fixed an issue that could cause Windows endpoints to return errors for the Patch - Deployment Results sensor.
• Fixed an issue that could cause Windows patch scans to fail on some non-English language endpoints.
• Fixed an issue that could prevent enforcement/deployments with non-English language characters in the name from being processed on endpoints.
• Fixed an issue that could prevent weekly Saturday/Sunday maintenance windows from properly enforcing.
• Fixed an issue that prevented the deletion of Yum repositories that were previously used in scan configurations.
• Fixed a race condition that could prevent initialization from automatically running after a Patch module upgrade.
• Fixed an issue that could introduce delays in file downloads on endpoints with Tanium Client.

Prerequisites

• Red Hat and CentOS endpoints require a minimum YUM version of yum-3.2.29-22.el6 to engage in Tanium Patch.
• Windows endpoints require a minimum operating system version of Windows 7 SP1 or Windows Server 2008 R2 SP1 to run Tanium Scan for Windows.
• Tanium Interact minimum version required is 2.4.74.

Known Issues and Workarounds

• If you are using Windows XP or Windows XP x64, you might need to run a Windows agent upgrade for reliable scanning and patch deployment.
• Leading and trailing whitespace is stripped from patch list and blacklist rule expressions on save.
• Creating a patch list or blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.
• Planned end-of-support for Windows versions in Tanium Patch: Future versions of Tanium Patch will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2).

Supported Tanium Platforms

Tanium Server 7.3.314.4250+, 7.4+

Tanium Patch 2.13.21.0000

Release Date: 20 October 2020

Resolved Issues

• Fixed a bug that allowed the Patch database to grow unexpectedly, resulting in degraded workbench performance and eventually Patch module upgrade failure.
• Fixed a bug that could cause the post install initialization to fail to run.

Prerequisites

• Red Hat and CentOS endpoints require a minimum YUM version of yum-3.2.29-22.el6 to engage in Tanium Patch.
• Tanium Interact minimum version required is 2.4.48.

Known Issues and Workarounds

• If you are using Windows XP or Windows XP x64, you might need to run a Windows agent upgrade for reliable scanning and patch deployment.
• Leading and trailing whitespace is stripped from patch list and blacklist rule expressions on save.
• Creating a patch list or blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.
• Planned end-of-support for Windows versions in Tanium Patch: Future versions of Tanium Patch will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2).

Supported Tanium Platforms

Tanium Server 7.3.314.4250+, 7.4+

Tanium Patch 2.13.19.0000

Release Date: 15 September 2020

Resolved Issues

• Fixed a bug where deleting a Scan Configuration failed with cascading errors.
• Fixed a bug that can cause Deployments using Direct Download to fail when Update Service Url Alternate related registry values are configured on an endpoint.
• Fixed a bug that caused scans on Windows endpoints to fail with the error Invalid procedure call or argument when scan results contained non-ASCII characters.
• Fixed a bug that caused Deployments utilizing Direct Download to fail due to changes to the Tanium Server Name on the client not being detected by the Patch process.
• Fixed a bug that could cause Windows Tanium Scan to produce empty results when Windows Update for Business or Dual Scan related registry values are configured on an endpoint.
• Fixed a bug that prevented limited users from using target by question in deployments.
• Refreshing of visibility group data is no longer subject to a half-hour throttle period.
• Fixed a bug that caused 'N/A' to show up as a selectable content set.
• Fixed a bug that caused the error 'SQLITE ERROR: No such column: NaN' to be displayed when selecting OS platform for a new deployment.
• Fixed multiple TDS related bugs.

Feature Improvements

• Increased the Patch plugin schedule frequency from once every 5 minutes to once every 30 seconds.

Prerequisites

• Red Hat and CentOS endpoints require a minimum YUM version of yum-3.2.29-22.el6 to engage in Tanium Patch.
• Tanium Interact minimum version required is 2.4.48.

Known Issues and Workarounds

• If you are using Windows XP or Windows XP x64, you might need to run a Windows agent upgrade for reliable scanning and patch deployment.
• Leading and trailing whitespace is stripped from patch list and blacklist rule expressions on save.
• Creating a patch list or blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.
• Planned end-of-support for Windows versions in Tanium Patch: Future versions of Tanium Patch will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2).

Supported Tanium Platforms

Tanium Server 7.3.314.4250+, 7.4+

Tanium Patch 2.13.0.0000

Release Date: 25 August 2020

Feature Improvements

• Enhanced RBAC allows assigning Patch Lists, Blacklists, Maintenance Windows, and Deployments to Content Sets, thus restricting access to users without rights to those content sets.
• New RBAC roles and permissions to make RBAC more granular.
  • See https://docs.tanium.com/patch/patch/requirements.html#user_roles for details.
  • Users will not be able to see or modify workbench objects for which they do not have Content Set access.
  • Users will not be able to see or modify objects that are deployed to computer groups for which they do not have Management Rights.
  • Prevent warning banners from displaying to users that do not have RBAC rights to retry them.
• Data improvements in the Patch workbench
  • All data/counts are scoped to the user that is signed in. Previously, counts were displayed from the entire enterprise. Now the counts take the user's computer group access into consideration.
  • Data for the last known state of offline machines is now included in all workbench views. This provides more complete data, but can be confusing the first time administrators see it if they are used to viewing online data only. Online counts can still be accessed from any of the drill downs in the workbench to Interact. Once in Interact, a toggle button exists to switch results between Current (online) and Cached (online + last known) data for most sensors used in Patch workbench.
  • Built-in Patch saved questions removed. This data is now collected automatically by the Tanium platform in a more efficient manner.
• AV Compatibility chart removed from the home page as its purpose is now obsolete.
• Performance/page load improvements across nearly every page in the Patch workbench.
• Reduced log churn in the Patch Service.

Bug Fixes

• Fixed bug that could cause slow group fetching on 7.4 Tanium Server versions to degrade Patch service and workbench performance.
• Added automatic retries for failed jobs in the Patch Workbench.
• Fixed a bug that caused warning banners to display after the banner was dismissed.

Prerequisites

• Red Hat and CentOS endpoints require a minimum YUM version of yum-3.2.29-22.el6 to engage in Tanium Patch.
• Tanium Server minimum version required is 7.4.
• Tanium Interact minimum version required is 2.4.48.

Known Issues and Workarounds

• This update removes any existing saved questions that start with “Patch - ” to clean up the way the product used to gather data. If you have saved questions you’d like to keep that are named in this manner, rename them prior to upgrade or wait for a subsequent release.
• Tanium Patch 2.13 is expected to be the last Patch release that supports Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2).
• Planned end-of-support for Windows versions in Tanium Patch: Tanium Patch version 3 is planned for release in 2020. Version 3.x will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2). Earlier versions of Tanium Patch will continue to function with older Windows versions; however, when version 3 is available, no new releases of Tanium Patch 2.x will be made.
• A Tanium Administrator should perform the upgrade to Interact 2.4.48 or later, as listed in Prerequisites.
• If the ServerName value in the Tanium Server registry key has been changed from the default of 0.0.0.0, the Tanium Client might fail to download patches and experience higher than normal CPU usage.
• If you are using Windows XP or Windows XP x64, you might need to run a Windows agent upgrade for reliable scanning and patch deployment.
• Linux endpoints require a minimum Tanium Client version of 7.2.314.3476 to runTanium Patch.
• Leading and trailing whitespace is stripped from patch list and blacklist rule expressions on save.
• Creating a patch list or blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.

Supported Tanium Platforms

Tanium Server 7.4+