Check Point Live Patch (CPLP) – TAC Clarifications and Practical Guide Offline Installation

[israelfds95]

Recently, I have been working with Check Point Live Patch (CPLP) as an alternative for quickly addressing critical CVEs while allowing more time to test and plan the deployment of newer Jumbo Hotfix Accumulator Takes.

The main CPLP documentation is available in sk185114.

While discussing CPLP with customers, several practical questions came up regarding AutoUpdater, future JH upgrades, dependencies, backup/restore, network connectivity, and how future CVE protections are delivered.

Since some of this additional information is not currently available in the official documentation, I opened a TAC case to clarify these questions and decided to share the additional information and clarifications provided by TAC here, to help all of us: 

In this article, I also provide a practical step-by-step procedure for enabling CPLP on offline Security Gateways, where the automatic installation and update process cannot be used.

1. Who is responsible for new CVE updates: AutoUpdater or CPLP?

According to TAC, CPLP is managed through the AutoUpdater framework.

When a new CVE is identified and a Live Patch is developed, AutoUpdater is responsible for checking for available updates and making them available to the system.

By default, AutoUpdater checks for updates approximately every 3 hours.

CPLP is the component responsible for applying the Live Patch fixes.

In short:

AutoUpdater → Update availability → CPLP → Live Patch application

2. Do we need to manually install a new CPLP Take for every new CVE?

Normally, no.

According to TAC, future supported CVE patches are generally intended to be delivered automatically through the AutoUpdater mechanism.

Manual download and installation remain available as a fallback option when needed.

3. How is CPLP distributed?

TAC clarified that CPLP is distributed as a single package.

This differs from solutions such as IPS or Anti-Virus/Anti-Bot, which receive updates as additional content packages.

4. Which URL does CPLP use for downloads?

This was an important question for customers with strict outbound access policies.

After checking with the responsible team, TAC confirmed that CPLP is currently downloaded from the same location used for Jumbo Hotfix packages through the Check Point Download Center.

The destination provided by TAC was:

https://dl3.checkpoint.com

According to TAC, allowing access to this destination should be sufficient for CPLP downloads.

TAC also recommended testing this connectivity in a lab environment before implementing the change in production.

5. Does AutoUpdater need to be manually restarted after autoupdatercli stop?

According to TAC, no manual restart is required.

AutoUpdater starts again after the manual installation process.

This question came up because the sk185114 shows on step 7 of "Installation Procedure for Offline Package (Single Machine)" -  "autoupdatercli stop", while an equivalent start option was not available in the CLI help.

6. What is the CPLP update workflow?

The detailed internal workflow is not publicly available, but was possible create a simple workflow with TAC informations.

At a high level, TAC confirmed that AutoUpdater periodically checks for available updates, approximately every 3 hours, and handles update availability for CPLP.

CPLP then handles the application of the Live Patch fixes.

7.Understanding AutoUpdater Status and Connectivity Validation

During testing, we observed autoupdatercli status reporting:

Downloading

even when the Gateway did not have connectivity to the update service.

After manually installing the required CPLP Take, the status changed to:

Ready

We asked TAC how AutoUpdater validates connectivity and whether there is a specific command or connectivity check available.

According to TAC, the internal connectivity validation mechanisms, backend checks, and detailed communication workflow are not publicly documented.

Therefore, the Downloading state by itself should not be considered documented proof that communication with the update infrastructure has been successfully established.

8. What should we check if an expected CVE patch does not reach armed?

TAC recommended initially checking:

• AutoUpdater is operating normally.

• The Gateway has connectivity to the required update services.

• CPLP is installed and functioning correctly.

Under normal conditions, AutoUpdater periodically checks for updates automatically, so a manual synchronization should generally not be required.

TAC also indicated that they were not aware of a documented command to manually force CPLP to download a specific CVE patch outside of the supported AutoUpdater workflow.

If an expected patch does not appear or fails to progress to armed, the recommendation is to open a support case for investigation.

9.What happens to Live Patches when upgrading to a newer Jumbo Hotfix? 

According to TAC, when upgrading to a newer Jumbo Hotfix Accumulator Take, Live Patch packages addressing vulnerabilities already fixed by the newer Take are typically superseded as part of the upgrade process.

10. Does CPLP create dependencies that could affect future JH upgrades?

According to TAC, Live Patch packages are designed to be self-contained.

They should not create persistent dependencies that would prevent future Jumbo Hotfix installations.

This was particularly important for customers considering CPLP as temporary protection while remaining on an already validated JHA Take.

11. Can CPLP interfere with restoring an older System Backup?

We specifically asked about restoring a System Backup created before the Live Patch installation.

According to TAC, restoring that backup returns the system to its previous state and the Live Patch will no longer be present.

TAC also confirmed that there are no known persistent dependencies that should prevent a successful restore.

12. How can a specific Live Patch be reverted?

TAC provided the following supported procedure.

First, identify the patch ID:

cplp list

Then revert the specific patch:

cplp revert --patch-id <patch_id>

Enabling CPLP in offline Security Gateways

Bellow, I will share a practical scenario I encountered with , where automatic CPLP deployment was not possible and the required components had to be installed manually.

The principal sk185114 describe "Installation Procedure for Offline Package (Single Machine)", the first step point to 

1. Manually install the latest with sk165653 AutoUpdater 
   
   

Offline Installation

1. Verify the currently installed CPupdates package:

   cpinfo -y CPupdates

2. Download the AutoUpdater package Check_Point_Deployment_Installer_Bundle_T31_AutoUpdate.tar from sk165653.

3. Install the AutoUpdater package using:

   autoupdatercli install

   Example:

4 - Download the Self Update package Check_Point_Self_Update_Bundle_linux50_T90_AutoUpdate.tar for your respective Gaia version.

5 - Confirm that AutoUpdater Take 31 was successfully installed and verify that the Self Update package Check_Point_Self_Update_Bundle_linux50_T90_AutoUpdate.tar is not yet installed
6 - Install the downloaded Self Update package Check_Point_Self_Update_Bundle_linux50_T90_AutoUpdate.tar.

7 - Execute autoupdatercli stop before next step as described

8 - Download the latest available BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take for your version from sk185114.

This is the: 

Check Point Live Patch (CPLP)

componet name - urgent_security_updates

9 - Install the downloaded BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take.




10 - Verify that all required Takes were successfully installed.


11 - Verify the CPLP patch status and the AutoUpdater state using:

[Oliver_Fink]

Thank you for this brilliant and extremely valuable summary. You write:

By default, AutoUpdater checks for updates approximately every 3 hours.

Just wanted to mention that we experienced differences of about 12 hours with different machines at different customers fixing CVEs via CPLP. Can the default be overridden or is that something that is hardcoded? How can we assure a prompt fix?

[israelfds95]

I'm glad you found the post useful!

Regarding your question, I couldn't find any information about how to reduce or configure this interval in the relevant SKs. I believe sk175504 is the most relevant documentation on this topic, but it doesn't provide any information about changing this interval.

I would suggest opening a TAC case to clarify this point. If you get an answer, could you please share it here with us? It would be great to add this information to the post as well.

[WiliRGasparetto]

As always, excellent content for the community, my friend.