Openssl issue CVE-2024-4741,CVE-2024-4603 and CVE-2024-2511 with Ncpa fo windows 3.1.0

Question

Openssl issue CVE-2024-4741,CVE-2024-4603 and CVE-2024-2511 with Ncpa fo windows 3.1.0

BlYuzucorp opened this issue 6 months ago · 20 comments

Hi,

You use risk openssl lib : c:\program files\nagios\ncpa\lib\libcrypto-3.dll and c:\program files\nagios\ncpa\lib\libssl-3.dll.
You use 3.0.13 and need to be upgraded to 3.0.14.

Thks

Answer 1 · 2024-06-24T13:25:09.000Z

This wouldn't be isolated to Windows, since NCPA does a private bind of the a few libraries and doesn't use the ones in the general linux distribution the agent is installed on.

It should be a priority if there are unresolved CVEs in the current NCPA version.

Answer 2 · 2024-06-30T14:22:44.000Z

This wouldn't be isolated to Windows, since NCPA does a private bind of the a few libraries and doesn't use the ones in the general linux distribution the agent is installed on.

It should be a priority if there are unresolved CVEs in the current NCPA version.

Not sure we are talking about he same thing. i speak about windows edition not linux edition of the package. SO the 3.0.14 library you bind had an issue with security.

Answer 3 · 2024-06-30T14:50:25.000Z

Yes, we are. I'm saying the security issue you mention wouldn't be isolated to the Windows NCPA version.

Answer 4 · 2024-07-01T10:05:09.000Z

" ..It should be a priority if there are unresolved CVEs in the current NCPA version. .."

i's a quite hard to understand. CVE described an issue with the current version and recommand to upgrade to new one. So why is not a priority ?

Answer 5 · 2024-07-01T13:39:47.000Z

FYI, there's also plenty of CVEs to the OpenSSL packaged with it (as far as I understand it comes with python) and the packaged version of OpenSSL is EOS according to MS Defender

Answer 6 · 2024-07-15T19:54:01.000Z

Is there any update on a updated package for resolving all the current CVE issues?

Answer 7 · 2024-07-17T22:06:53.000Z

yes 3.0.14 : https://www.openssl.org/news/vulnerabilities.html

Answer 8 · 2024-07-17T22:08:11.000Z

and 3.0.15 for new CVE-2024-5535

Answer 9 · 2024-07-17T23:05:09.000Z

@BlYuzucorp My statement wasn't directed to you but the NCPA package maintainers in regards to getting an updated NCPA package.

Answer 10 · 2024-07-25T19:14:16.000Z

@sawolf @ne-bbahn

I'm surprised there's not been any (at least perceived) activity on getting an updated agent package that includes the current unresolved CVEs. Is anyone looking into this?

Answer 11 · 2024-07-26T15:17:42.000Z

@MrPippin66
I am investigating build options and will get back to you soon.

Answer 12 · 2024-07-26T15:24:27.000Z

Thanks for the update. I'm holding off doing our 3.1 rollout pending this being resolved.

Answer 13 · 2024-07-26T22:44:37.000Z

Since the addition of OpenSSL 3 in Python, our Windows version of NCPA uses the OpenSSL version bundled into the Python release. As of this moment, Python 3.13 is in beta and the latest 3.12 (3.12.4) is built with OpenSSL 3.0.13 (the version currently in NCPA 3.1.0), so the Windows build is blocked on that front until Python updates the version that they're using. There was a version of the windows build that I had made that downloaded and built Python from source with a custom version of OpenSSL, but I would have to dig that up and update it to work with the current version of NCPA.

On the Linux front, we could update to use OpenSSL 3.0.14, but 3.0.15 isn't available from the OpenSSL website and I haven't looked into getting OpenSSL 3.3 working with NCPA. I am out for the next week, but I can look a little closer when I get back.

Answer 14 · 2024-07-27T00:02:08.000Z

Openssl 3.0.14 does include the fixes involved in the main part of this issue.

Major changes between OpenSSL 3.0.13 and OpenSSL 3.0.14 [4 Jun 2024]

Fixed potential use after free after SSL_free_buffers() is called ([[CVE-2024-4741](https://openssl-library.org/news/openssl-3.0-notes/vulnerabilities.html#CVE-2024-4741)])
Fixed an issue where checking excessively long DSA keys or parameters may be very slow ([[CVE-2024-4603](https://openssl-library.org/news/openssl-3.0-notes/vulnerabilities.html#CVE-2024-4603)])
Fixed unbounded memory growth with session handling in TLSv1.3 ([[CVE-2024-2511](https://openssl-library.org/news/openssl-3.0-notes/vulnerabilities.html#CVE-2024-2511)])

So those can be resolved in the Linux side. Clearly doesn't address the Windows side of these CVEs.

And it's still desirable to address the python ssl module issue, if possible. CVE-2024-0397. (if not already addressed)

Answer 15 · 2024-08-25T22:04:51.000Z

Is any progress being made on this?

Answer 16 · 2024-09-04T16:09:49.000Z

Is any progress being made on this?

Yes. Sorry for the wait, I've been out of town. We will be moving into QA shortly on NCPA 3.1.1, which will update the Linux version to use OpenSSL 3.0.15 and the Windows build's Python version to 3.12.5.
Unfortunately, this version of Python still uses OpenSSL 3.0.13 and as much as I would like to finish out the Windows custom OpenSSL build script, I do not have time to dig up and finish it in the foreseeable future, so the Windows version is stuck with whatever is packaged with the most recent Python release.

Answer 17 · 2024-09-04T16:14:28.000Z

Thanks for the update

Answer 18 · 2024-09-13T18:38:33.000Z

Is any progress being made on this?

Yes. Sorry for the wait, I've been out of town. We will be moving into QA shortly on NCPA 3.1.1, which will update the Linux version to use OpenSSL 3.0.15 and the Windows build's Python version to 3.12.5. Unfortunately, this version of Python still uses OpenSSL 3.0.13 and as much as I would like to finish out the Windows custom OpenSSL build script, I do not have time to dig up and finish it in the foreseeable future, so the Windows version is stuck with whatever is packaged with the most recent Python release.

Sorry to push, but is there any ETA on a possible linux release to address the OpenSSL issues?

Answer 19 · 2024-09-13T21:09:49.000Z

Is any progress being made on this?

Yes. Sorry for the wait, I've been out of town. We will be moving into QA shortly on NCPA 3.1.1, which will update the Linux version to use OpenSSL 3.0.15 and the Windows build's Python version to 3.12.5. Unfortunately, this version of Python still uses OpenSSL 3.0.13 and as much as I would like to finish out the Windows custom OpenSSL build script, I do not have time to dig up and finish it in the foreseeable future, so the Windows version is stuck with whatever is packaged with the most recent Python release.

Sorry to push, but is there any ETA on a possible linux release to address the OpenSSL issues?

We should be releasing NCPA 3.1.1 early next week.

Answer 20 · 2024-09-15T07:46:55.000Z

That's a good news. Just for info, Python released version 3.12.6 for openssl issue.
Release note :
...
Windows
Updated Windows build to use OpenSSL 3.0.15.
...