🚨 IMPORTANT: Update

openvox-agent

,

openvox-server

,

openvoxdb

, and

container-openvoxdb

ASAP 🚨 The following new releases contain fixes for critical 9+ CVSS vulnerabilities. Please update as soon as possible. See voxpupuli.org/blog/…/critical-cve-updates for more details. • openvox-agent 9.3.0, 8.32.0 • openvox-server 9.2.0, 8.18.0 • openvoxdb 9.2.0, 8.18.0 • container-openvoxdb 8.18.0 The vulnerabilities are currently GitHub advisories, and will become CVEs once we have numbers assigned to them. github.com/OpenVoxProject/openvox/…/GHSA-ffr6-rwpm-p5wq github.com/OpenVoxProject/trapperkeeper-authorization/…/GHSA-q4hm-33rc-572g github.com/OpenVoxProject/container-openvoxdb/…/GHSA-c4wc-g5pp-7wfp The linked blog post also contains patching scripts if for some reason you are unable to update to the latest versions immediately. Note that these are provided as-is and you assume responsibility if using them in your environments. We strongly suggest updating to the latest package versions instead.

I think it's time for a nap now

nap? go vote 😛

oh, that is definitely happening today.

Done last week! Oregon is great that way.

Can you please mark the new packages as security updates in the package repositories ?

yum update --security

does not pick up the update while

yum update

does

Good call out, yes, I'll look into this

We have automatic security updates, but non-security updates have to be done manually across our infrastructure, so if they are tagged security, it will all get updated automatically.

I would like to mention that the containerized versions of openvoxserver and openvoxdb have been built, tagged, and pushed out with the vulnerability fixes. Let me know if anyone has issues. :)

@maxime.boissonneault People are dropping off for the day, but I think I have a solution for our release infrastructure, so I'll try to get this implemented tomorrow.

Someone i know is asking if 7 is effected in all? They are still running it. Thank you!

Yes, basically everything back to Puppet 5

I'm not seeing any updated packages....

OpenVox 7 is long since dead, along with the packaging pipeline for it. It was basically only a repackaging of Puppet 7 meant to help people migrate to OpenVox 8. I strongly urge anyone on 7 to upgrade. But if you can't, the blog post gives some scripts that can be used to patch your existing packages.

okay, thank you. I've passed along the information.

@Nick Burgan thanks. Let me know when it’s done and I can confirm if it works.

FWIW we have patched 200ish openvox7 servers with the scripts at the blog post and it went smoothly. Thank you!

@maxime.boissonneault All of the relevant packages should now be marked as security updates. Should be visible with a

yum update --security --refresh

.

yup, it works!