Known issues in HCL AppScan 360°

Known issues in releases, and workarounds when applicable.

Known issues in AppScan 360° version 2.0.0

  • IAST Agent download fails when AppScan 360° is reinstalled with the same version, but a new database.
  • During distributed installation, component pods are not displayed when custom namespaces are used. This is due to default namespace values; does not impact the installation process.
  • If AppScan 360° was installed with a custom ASRA or SCA namespace, uninstalling using teardown.sh may fail. Try uninstalling individual components separately.

  • When DAST Open API scanning is configured with automatic API authentication, the scan fails with the message Out-of-session during Explore stage. To avoid this scenario, configure Open API scans with recorded or API key authentication.

  • Adding user with email is not supported for Domino LDAP.

Known issues in AppScan 360° version 1.4.0

  • The Install AppScan GitHub Application button or link under SAST scan will work only after you select a Presence.
  • Under Domain Management, the Asset group filter "All" is not working as expected.
  • For scheduled scans, ESM logs are not being recorded.
  • Automatic update of AppScan Go! is not functional. See Automatic update of AppScan Go! fails for more information.

Known issues in AppScan 360° version 1.3.0

  • If a scan fails within a minute or two with the message, "Error: An unknown error occurred", either:
    • The server is down or unreachable, or
    • The starting URL is incorrect.
    Download the log file to confirm the issue:
    1. From the AppScan 360° Scan page, select Manage Scan > Download Log.
    2. Download the .ZIP file and extract its contents.
    3. Open ScanLog_<yy>.log (where yy is number between 1 and 100).
    4. If the message CRWAD0601I - [ServerDown] Cannot connect to host: is present:
      • Verify that the target server is reachable and responding, and/or
      • Verify that the starting URL is entered correctly.
  • After entering the starting URL for a scan, you may see the error message, "Unless this is a private network, please verify your domain. Learn more." Check the starting URL as entered for leading spaces. Remove the whitespace characters and try again.
  • Encrypted traffic file is not supported.
  • If a scan has multiple executions, the log file will have multiple files with the same name. To extract the log files, use an archive utility that supports auto-rename feature such as 7zip.

Known issues in AppScan 360° version 1.2.0

Known issues in AppScan Central Platform
  • On some installations, regulatory and compliance reports generate without any issues.

    To resolve the issue, restart the pod that starts with ascp-mr-tasks-manager for the scheduler to refresh the data for the report. In most cases the reports start to function after 20 minutes, but occasionally it may take up to 24 hours.

  • When working with scan results, clearing filters using the Clear option in the Filters dialog box removes all issues.
  • When attempting to generate a security report for a filtered list of fix groups, the report may fail to generate.
  • If you deploy a scan, but there are insufficient resources to run the scan, the scan may stall and not progress, even while showing at state of "Running" in AppScan Central Platform.
    Check the status of the scan in the K8S cluster. The status of the scan (name starting with sast-job-) may be "Pending". In this instance you can either:
    • Wait for other scans to finish and resources to free up. The Running/Pending scan will proceed when sufficient resources are available.
    • Add more resources and redeploy the scan.

Known issues in AppScan 360° version 1.1.0

Known issues in AppScan Central Platform

  • On some installations, regulatory and compliance reports generate without any issues.

Known issues in AppScan 360° Static Analysis

  • Upgrading from AppScan 360° version 1.0.0 fails.

    Error:

    Deployment fails during upgrade due to failure to upgrade the version of RabbitMQ:
    • Feature flags: classic_mirrored_queue_version: required feature flag not enabled! It must be enabled before upgrading RabbitMQ.
    • Failed to initialize feature flags registry: {disabled_required_feature_flag, classic_mirrored_queue_version}
    Root cause

    Version 1.0.0 of AppScan 360° Static Analysis uses version 3.11.10 of RabbitMQ, which has since been upgraded. When an existing deployment of AppScan 360° Static Analysis version 1.0.0 is upgraded with AppScan 360° Static Analysis version 1.1.0 or later, the deployment fails until featureflags are enabled to allow upgrade of RabbitMQ.

    Solution

    Before upgrading, manually enable featureflags in the RabbitMQ pod:
    1. Open a shell into the active and running RabbitMQ pod
    2. Run the command rabbitmqctl enable_feature_flag all.
    3. Deploy AppScan 360° Static Analysis to upgrade .

    Alternatively, uninstall AppScan 360° Static Analysis version1.0.0 and perform a fresh install of AppScan 360° Static Analysis version 1.1.0