How can security patches be applied to specific packages?
-
Hello, if I I want to update openssh for example and fix the forwarding vulnerability (CVE-2023-38408). Is it posibble?
I saw there are patches for certain FreeBSD versions but the pfSense is in a different version (FreeBSD 14.0-CURRENT) and it says it is up to date.
Thanks.
-
@AR-0 Base packages are updated as part of the core pfSense software.
Most vulnerabilities are either mitigated by shutting down the package (like not running SSH) or aren't actually exploitable in pfSense.
I cannot speak for any specific CVE but if there's a security vulnerability that can be exploited and cannot be mitigated without replacing the binary there will be a dot release for the software.AFAIK there is no plan for a 23.05.2 release at this time and 23.09 will have any needed binary updates.
-
@rcoleman-netgate Thank you!
-
J jimp moved this topic from Problems Installing or Upgrading pfSense Software on
-
@AR-0 said in How can security patches be applied to specific packages?:
CVE-2023-38408
In that particular case it does not affect anything in the standard operation of pfSense. It only applies to SSH clients so would only be applicable at all for someone using pfSense as a client in some custom way.
-
@stephenw10 I see, thank you very much for your answer
