Missing Debian Security Updates

[simbar]

See https://www.3cx.com/community/threads/debian-installer-eol.121434/

Does your Linux distribution have the latest LTS security patches in place.

Example of an issue we are seeing on our 3CX instance

Here is one of the issues
https://lists.debian.org/debian-lts-announce/2023/05/msg00014.html
Package : postgresql-11
Version : 11.20-0+deb10u1
CVE ID : CVE-2023-2454 CVE-2023-2455

Two security issues were found in PostgreSQL, which may result in
privilege escalation or incorrect policy enforcement.

For Debian 10 buster, these problems have been fixed in version 11.20-0+deb10u1.

Version installed on 3cx server:
dpkg -s postgresql-11 | grep Version
Version: 11.19-0+deb10u1

 

[Evolute IT]

Do you have automatic updates enabled? If so, those updates will autoinstall when 3CX adds them to their repo.

 

[simbar]

Yes


Why are they not already added to the repo? Debain released security patches for the issue highlighted above in May?

 

[Evolute IT]

Okay then they should update that soon. Probably with U8 once it gets released.

 

[simbar]

It's been nearly a month. The issue above has a high CVE score.
I've only highlighted one issue above there are many recent missing security patches from Debian.

They should be pulling down the up stream security patches much quicker than that.

 

[Evolute IT]

Feel free to add the default Debian repos and install them if you so desire. Just note that you won't be supported anymore.

The reason it takes this long is because they test every updates to make sure that nothing breaks the software. This is a good thing, otherwise an update to Postgres could potentially break the whole thing. We don't want that.

 

[Charles_3CX]

We have moved this post to the self-hosted section of the forum as it is not directly related to an AV/EDR report, and we are looking into this internally.

Thank you.

 

[NikosT_3CX]

Hi, we had feedback from the appropriate team which manages the security patches and they're
finalizing testing and they will push security updates sometime next week.

 

[Ronin]

Hello @NikosT_3CX ,

Are the security updates released yet?
We are currently on Version: 11.19-0+deb10u1

 

[Charles_3CX]

They were released earlier this week for Update 7+8.

 

[NikosT_3CX]

@Ronin please check here for update 7 and 8 : https://www.3cx.com/blog/releases/debian-security-updates/