Security issue with libexpat

[Jon R]

Hey,

Not sure if this is the right place - our vulnerability scanner has picked up that our 3CX server (official ISO installation) is running a vulnerable version of libexpat1. 3CX has pinned the previous version, so an apt upgrade won't update it. I think we're running the latest version of everything.

The CVE https://www.debian.org/security/2022/dsa-5073
Our version: 18.0 update 3 (Build 314)
Excerpt from /etc/apt/preferences.d/3cxpbx:
Package: libexpat1
Pin: version 2.2.6-2+deb10u1

Cheers

 

[NickD_3CX]

Hi!

I have just checked the package versions that we have marked, if in your Management Console --> Dashboard --> Updates, you have enabled the "Automatically update 3CX" option, this package will be installed.
If it's not on right now, enable it, set the interval to daily and set it to an hour during the night, then wait 24h.

If by then it is not installed, please log onto your 3CX Server via SSH and run command lsb_release -a to tell me what the output is.

 

[Jon R]

I've checked after the update should have happened and nothing has changed.

Out of lsb_release

root@pbx:/home/jr# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 10 (buster)
Release: 10
Codename: buster

 

[NickD_3CX]

Log into your 3CX server via SSH and run this command:

cat /var/lib/3cxpbx/Data/Logs/unattended-upgrade.log

What is the output, can you post it here?

 

[Jon R]

Still no changes. I've run the command:

root@pbx:/home/jr# cat /var/lib/3cxpbx/Data/Logs/unattended-upgrade.log
--2021-11-30 00:48:00--  https://downloads-global.3cx.com/downloads/v180/debianupdate/buster.txt
Resolving downloads-global.3cx.com (downloads-global.3cx.com)... 104.22.15.119, 104.22.14.119, 172.67.39.236, ...
Connecting to downloads-global.3cx.com (downloads-global.3cx.com)|104.22.15.119|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: ‘/tmp/pinning.tmp’

     0K .......... .......... ....                             31.7M=0.001s

2021-11-30 00:48:00 (31.7 MB/s) - ‘/tmp/pinning.tmp’ saved [25484]

Pin file downloaded
Get:1 http://security.debian.org buster/updates InRelease [65.4 kB]
Hit:2 http://downloads-global.3cx.com/downloads/debian buster-testing InRelease
Hit:3 http://downloads-global.3cx.com/downloads/debian buster InRelease
Hit:4 http://deb.debian.org/debian buster InRelease
Get:5 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Fetched 117 kB in 1s (118 kB/s)
Reading package lists...
All upgrades installed
Security updates have been installed.
/usr/lib/x86_64-linux-gnu/libapt-pkg.so.5.0.2
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.2.4
/usr/lib/x86_64-linux-gnu/libgnutls.so.30.23.2
Reboot required.

 

[NickD_3CX]

The problem is that the last time this was triggered was on 2021-11-30 as shown in the log.

I'll PM you shortly.