Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#2708 closed task (fixed)

Patch update on all systems

Reported by: robe Owned by: sac@…
Priority: normal Milestone: Unplanned
Component: SysAdmin Keywords:
Cc:

Description

In particular for vulnerability

​https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034

Change History (3)

comment:1 by robe, 3 years ago

updated backup, osgeo6, osgeo8, and osgeo9 osgeo3, osgeo4, osgeo7 were already up to date

Patch updated containers:

osgeo4 

hop
osgeo4-nginx
old-web-staging #shut off
wiki-staging
wordpress-staing
wordpress-dev
secure-dev
tracsvn-dev

osgeo7 

download #already updated
dronie-server
nextcloud
nginx #already up to date
secure #already up to date
tracsvn

osgeo3 

limesurvey
matrix
nexus
osgeo3-nginx
pretalx

comment:2 by robe, 3 years ago

Resolution: → fixed
Status: new → closed

osgeo 3 

grass-wiki
wiki

osgeo 7 

collabora
grass #up to date
live
mapserver
pycsw

osgeo 9 containers 

hop #already up to date
weblate

The older containers are harder to patch since the OS needs to be upgraded. As far as polkit goes I think the only danger is from people who are in shell group (have ssh into hop containers). Those are fairly trusted people anyway.

comment:3 by robe, 3 years ago

I did check several of the old containers and they didn't seem to have pkexec on them at all. old-web, old-projects, old-webextra

Note: See TracTickets for help on using tickets.