3CX Security Patch Log

[Zahed]

Dear 3CX Team,

One of our clients had a security vulnerability audit on 3CX server (with ssh access to the server) and then produced the attached vulnerability log ( with client info edited out ).

First, would be grateful to get a feedback from 3CX team about this file entries. some of these entries asking for grub password or modify pastgres file permissions. but this is not the main question.

Is there a thread or website page that mention all the CVE vulnerability solved in 3CX with 3cx version that solved it? having a reference list like this from the vendor (3cx team) will help a lot respond to the clients and their security auditing teams.

Due to AI boom and the accelerated hacking happening in the world. a lot of our clients are doing these audits and requesting fixes (got 3 reports just this month). and some of these entries are false alarms. for example one of their entries was (CVE-2024-6387) than mention openssh 9.2p1 vulnerability and suggest installing version 10+. I checked the Debian security tracker to discover that it is already fixed in the current version 1:9.2p1-2+deb12u10.

Now i have to repeat this process for each CVE entry and search in sites outside 3CX. or make a similar post here. which is impractical for both me and 3CX team.

If we can have an official 3CX post or website page for all solved CVE entries and the version that has it solved, I can just fast search it and give an official response to the client directly from your official page.

Also, there could be some official mechanism to privately post these reports to 3CX team so they are updated on security reports from clients (free audit reports for 3CX).

If such a thing already exist please forgive my ignorance and direct me to it.

Thanks.

 

[KyriacosS_3CX]

Hello, you can find the security changelog here: https://www.3cx.com/blog/change-log/pbx-security-updates/

 

[NikosT_3CX]

@Zahed regarding the CVE-2024-6387 as I can see this is fixed and already applied in U9 and also U10 :

bookworm

1:9.2p1-2+deb12u10

bookworm (security)

1:9.2p1-2+deb12u9

Also as my colleague mentioned above check the Security Change log.
Ensure that you have automatic updates enabled on the PBX and then after these are applied then scan again.
For the " brotli " this is already applied as per our Change Log.

NOTE : on your report I can see at the end " Disable ICMP redirect support " so I would recommend applying
a firewall in front of the machine and disable this.

 

[Zahed]

Thank you for the prompt feedback.

I compared the change log with the list. i think the "bind9" package update is still missing. also, any feedback for the entries under the "general" section (except the ICMP which was answered).