Folks, are Citrix still releasing CVE patches for Netscaler 12.1? I understand it went EOL around a year ago. I got asked the question... I can see there are recent releases for FIPS/NDcPP. Assuming they can only be used by government customers etc? cheers

I dont think so mate, was a major reason for customers moving on to 13.0++

Cheers, Nick. Thats what I thought. I noticed this from Jan 2024..

I dont know what they are - i havent looked in the 12.1 section in ages. - time to move to 13.1 in any event 🙂

I get that... the question being asked it "so there been ZERO patches' since it went EOL.. and you know who is asking me this 😉

Check out the matrix here https://www.citrix.com/support/product-lifecycle/product-matrix.html

And in case they ask - do not use FIPS firmware on non-FIPS appliances. Hopefully they've built in some kind of sanity checking to prevent it but if you manage to load FIPS firmware on a standard box you will likely end up RMAing it.

definitely not for 12.1 anymore

Zero patches for 12.1 any more, and explicitly called out as vulnerable in the last CVE CTX article https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549

Mike: I'm not so sure, I saw someone not used to working in Citrix, upgrading an old 12.1 non-FIPS, to 12.1 FIPS, and it worked; this was on a non-FIPS VPX to be fair, so it might be different for a physical box. Either way, I'm in full agreement now and then, don't use FIPS if you don't know what it stands for.

I have personally had to bail out support after they instructed a customer to upgrade a standard SDX with SDX-FIPS code (or vice versa, it's been a couple years) and effectively bricked it. Sure VPXes are more likely to be recovered easily but regardless do not depend on guardrails that may not exist.

Oh, absolutely, I'm not saying it is advisable, just that I was surprised that it did work; I expected it to be a mess when they said it had been installed, but I didn't spend too much time looking at it, except for saying it was a big no no.

Thanks all 🙂