Hi, I used Nessus scan and found some packages with security bugs. It doesn’t affect VYOS to much but we need to patch them.
Please see in report.
Found many vulnerabilities with affect Denial of Service.
Description
Description
Details
Details
- Difficulty level
- Easy (less than an hour)
- Version
- Vyos 1.3.3
- Why the issue appeared?
- Will be filled on close
- Is it a breaking change?
- Perfectly compatible
- Issue type
- Security vulnerability
Related Objects
Related Objects
- Mentioned In
- 1.3.6
Event Timeline
Comment Actions
I assume this will fix by itself if you build your own 1.3.3 LTS from sources today since 1.3.3 LTS was released in june 2023:
https://blog.vyos.io/vyos-1.3.3-lts-release
Or wait for 1.3.4 LTS to be released (which would also automagically fix most of these findings).
The thing with VyOS builds is that they will use current version of packages for the Debian version the build is based on, which for 1.3 series looks to be Debian 10 buster - where 1.4 series is based on Debian 12 bookworm.
That is if the released 1.3.3 LTS was built mid june 2023 this means if you build 1.3.3 LTS yourself today 25 aug that will include all the fixes that have been released for Debian 10 buster between mid june 2023 until late aug 2023.