3CX Security Patch Log

[Zahed]

Dear 3CX Team,

One of our clients had a security vulnerability audit on 3CX server (with ssh access to the server) and then produced the attached vulnerability log ( with client info edited out ).

First, would be grateful to get a feedback from 3CX team about this file entries. some of these entries asking for grub password or modify pastgres file permissions. but this is not the main question.

Is there a thread or website page that mention all the CVE vulnerability solved in 3CX with 3cx version that solved it? having a reference list like this from the vendor (3cx team) will help a lot respond to the clients and their security auditing teams.

Due to AI boom and the accelerated hacking happening in the world. a lot of our clients are doing these audits and requesting fixes (got 3 reports just this month). and some of these entries are false alarms. for example one of their entries was (CVE-2024-6387) than mention openssh 9.2p1 vulnerability and suggest installing version 10+. I checked the Debian security tracker to discover that it is already fixed in the current version 1:9.2p1-2+deb12u10.

Now i have to repeat this process for each CVE entry and search in sites outside 3CX. or make a similar post here. which is impractical for both me and 3CX team.

If we can have an official 3CX post or website page for all solved CVE entries and the version that has it solved, I can just fast search it and give an official response to the client directly from your official page.

Also, there could be some official mechanism to privately post these reports to 3CX team so they are updated on security reports from clients (free audit reports for 3CX).

If such a thing already exist please forgive my ignorance and direct me to it.

Thanks.

 

[KyriacosS_3CX]

Hello, you can find the security changelog here: https://www.3cx.com/blog/change-log/pbx-security-updates/

 

[NikosT_3CX]

@Zahed regarding the CVE-2024-6387 as I can see this is fixed and already applied in U9 and also U10 :

bookworm

1:9.2p1-2+deb12u10

bookworm (security)

1:9.2p1-2+deb12u9

Also as my colleague mentioned above check the Security Change log.
Ensure that you have automatic updates enabled on the PBX and then after these are applied then scan again.
For the " brotli " this is already applied as per our Change Log.

NOTE : on your report I can see at the end " Disable ICMP redirect support " so I would recommend applying
a firewall in front of the machine and disable this.

 

[Zahed]

Thank you for the prompt feedback.

I compared the change log with the list. i think the "bind9" package update is still missing. also, any feedback for the entries under the "general" section (except the ICMP which was answered).

 

[NikosT_3CX]

@Zahed as I can see on Debian Tracker ( and also for the rest of the mentioned CVEs )the vunerable packet is 1:9.18.49-1~deb12u1 which is not installed on the PBX side U9 & U10 as well.

 

[aholmes-think]

You can push debian updates via SSH access at your own discretion, you dont have to wait for 3CX to do it. Like any update, make sure you deploy in testing environment first. This is something we do via our platform as some of our clients want up to the minute OS level updates completed.

 

[Zahed]

Yes that was the plan.

But the main point is having the vendor response because most of the clients that do the security audits are government or semi government establishment. the "officiality" of the response and vendor (3CX) support are as important as the fix itself.

Just telling them that the vendor will provide this in the next patch or will not, is part of the solution decision making for them. in fact, if the risk of one of the CVE entries is low and will not be fixed by vendor they may accept leaving it to keep the installation clean and vendor supported.

Also, I'm fully aware 3CX team takes security very seriously. so there is a big chance they will apply these fixes if its applicable. or give a reasonable timeframe for it.

And some of these audits are way over the top. if you check the file they are asking to change the permission and owner of postgres log file or Enable GRUB password. I believe that's a decision only 3CX team can safely respond to such request. even if it is a negative response.

I will still go for the updates myself it is the last forced option i have.

 

[aholmes-think]

Oh just thought of another thing you can do, I believe you can turn on auto-updating in Debian as well. This way you set the schedule and make sure updates are constantly kept up to date. You'd have to weigh the risks of a bad patch vs. security, but it's an option.

 

[SteveITS]

20u10 has a separate option for daily security updates.