VyOS - Blog

Remote code execution in listening Zabbix agent (CVE-2023-32728)

daniil@sentrium.io (Daniil Baturin) — Thu, 24 Oct 2024 09:17:37 GMT

Hello, Community!

Our community member Fabian Riechsteiner brought to our attention that the version of the Zabbix agent present in VyOS 1.4.0 is susceptible to a remote code execution vulnerability — CVE-2023-32728. We made a hotfix available to subscribers, and the fix will be a part of the upcoming VyOS 1.4.1 release.

CVE-2024-6387 (regreSSHion)

daniil@sentrium.io (Daniil Baturin) — Mon, 01 Jul 2024 10:24:00 GMT

Hello, Community!

Today Qualys's security team has disclosed a remotely exploitable vulnerability in OpenSSH server. It was assigned CVE-2024-6387 number and nicknamed "regreSSHion" because its cause is an accidental removal of code that fixed a much earlier vulnerability back in 2006. It affects OpenSSH versions older than 4.4p1 and versions between 8.5p1 and 9.8p1. VyOS 1.3.8 includes OpenSSH 7.9p1 and thus isn't vulnerable. VyOS 1.4.0 includes 9.2p1 and will need a patch to remain secure.

Zenbleed and OpenSSH agent vulnerabilities and their impact on VyOS

daniil@sentrium.io (Daniil Baturin) — Thu, 27 Jul 2023 10:16:51 GMT

Hello, Community!

Recently, two severe vulnerabilities were discovered by security researchers. One of them is nicknamed Zenbleed (CVE-2023-20593) and affects a number of AMD CPUs, the other one (CVE-2023-38408) affects OpenSSH. Both are potentially very serious but, luckily, don't affect most VyOS users. We will include fixes for them in our next releases, of course, and we can provide hotfix packages to people who need them now.

Recent OpenSSL vulnerabilities do not affect any VyOS versions

daniil@sentrium.io (Daniil Baturin) — Thu, 03 Nov 2022 13:50:29 GMT

Many people are concerned about recently announced OpenSSL vulnerabilities (CVE-2022-3786 and CVE-2022-3602). However, none of the VyOS versions ever released are vulnerable. Those vulnerabilities affect only OpenSSL version 3.0.x, while VyOS uses 1.1.1n in the 1.3.x LTS line and in the nightly builds of the upcoming 1.4 release, and that version is not vulnerable.