This message was deleted.
# citrix-netscalers
Slackbot
01/11/2024, 5:13 AMThis message was deleted.
m
Mads Petersen
01/11/2024, 9:54 AMIs it the Terrapin one? I've asked NetScaler and they should release some public info soonish.
d
Daniel Marsh
01/11/2024, 9:01 PMNo they didn't even mention that one! They've listed 4 CVEs - CVE-2020-14145, CVE-2023-38408, CVE-2021-36368, CVE-2016-20012. CVE-2023-38408 and CVE-2021-36368 are related to agent forwarding so that's not applicable, and CVE-2016-20012 isn't really a vulnerability as such, the OpenSSH devs term it "partial disclosure of non-sensitive information". We've mitigated all of this because admin interfaces are only accessible from a restricted management VLAN, but they've still asked us to query it with Citrix anyway.
c
CTXMike
01/11/2024, 11:28 PMVulnerability scans that only consider the reported version of components like OpenSSH aren't accurate - the NS team manually applies patches instead of upgrading the entire package. In the past you could reach out to the secure@ citrix email address with the CVE IDs plus your firmware version and they would reply back with confirmation of patch/mitigation status.
👍 2
d
Daniel Marsh
01/14/2024, 8:27 PMThanks Mike, I will do that.
Daniel Marsh
01/16/2024, 10:53 PMFYI - the response from Citrix is:
"We are currently working on the OpenSSH upgrade project in response to CVE-2023-38408 and expand the scope to accommodate CVE-2023-48795 as well. This is a multi PI effort
as we have to update ADC, SVM, and ADM-on-prem together. This is a top security project for the team and is currently actively work in progress.
This project is quite an involved effort here in terms of backports to multiple release trains, testing, validation etc..
From timelines perspective, we believe we would be ready by 1H2024 (Note : This can be subject to change if there are blockers/new findings in the due course)."
👍 3
3 Views