3CX V18 - Postgresql 11.9 - 19x vulnerabilities (10x High CVE)

[CodeTwo]

Hello,

Microsoft Defender is reporting that 3CX V18 build 18.0.8.939 is vulnerable (over 19x vulnerabilities so far) because of old version of Postgresql which is 11.9.0.0.
Affected file: C:\...\3CX Phone System\Bin\pgsql\bin\clusterdb.exe

When you will fix this vulnerable version of Postgresql and in which version? There is no information within https://www.3cx.com/blog/change-log/phone-system-change-log/

 

[bitn2]

I would update your pbx and test again... Maybe it is fixed in this version or in v20...

 

[CodeTwo]

I would like to know it officially. We will stay with version V18 so far. There is no information within change-log. No new version since December 2023.

 

[bitn2]

V18 is on 18.0.9.20 allready. Your version is old.

 

[CodeTwo]

Can you confirm that in this version Postgresql was updated? There is no info within change-log.

 

[bitn2]

Can you confirm that in this version Postgresql was updated? There is no info within change-log.

No, i didnt test this by my self.

 

[bitn2]

https://www.3cx.com/blog/news/sql-database-integration-update/

 

[N_G]

If you use Windows then you must be on a LAN locked down with firewall. We will not create new builds of the windows version of for each postgress. So best thing to do is install latest version of 3CX on Linux if you are very concerned about fast security updates to postgress.