Security issue thread - PHP and eMudhra cert compromise

[humpty]

@jdaviescoates according to chatgpt the following are php based (not a complete list):

• nextcloud
• roundcube
• wordpress
• freescout
• yourls
• Invoiceninja

edit: I know you also use navidrome (not php). N8n, Joplin, Vaultwarden are all safe (non-php based).

[jdaviescoates]

@girish said:

grep -A2 'ca-certificates' /var/log/apt/history.log | tail -n

that's missing a number at the end. I went for:

grep -A2 'ca-certificates' /var/log/apt/history.log | tail -n 3

[p44]

@nebulon Thanks Nebulon and thanks for all your efforts

[msbt]

there used to be a filter like https://git.cloudron.io/packages?filter=php that worked, but not anymore apparently

[luckow]

@jdaviescoates as fas as i know:
2fauth
ampache
bookstack
castopod
dokuwiki
dolibarr
easyappointments
espocrm
firefly-iii
freescout
freshrss
glpi
grav
humhub
invoiceninja
jirafeau
kanboard
kimai
koel
leantime
limesurvey
lychee
matomo
mautic
mediawiki
monica
moodle
nextcloud
omeka-s
opodsync
osticket
piwigo
pixelfed
privatebin
roundcube
rss-bridge
shaarli
snappymail
snipeit
tachyon
tinytinyrss
wallabag
wallos
wordpress-developer
wordpress-managed
xbackbone
yourls

[jdaviescoates]

@luckow said:

@jdaviescoates as fas as i know:
2fauth
ampache
bookstack
castopod
dokuwiki
dolibarr
easyappointments
espocrm
firefly-iii
freescout
freshrss
glpi
grav
humhub
invoiceninja
jirafeau
kanboard
kimai
koel
leantime
limesurvey
lychee
matomo
mautic
mediawiki
monica
moodle
nextcloud
omeka-s
opodsync
osticket
piwigo
pixelfed
privatebin
roundcube
rss-bridge
shaarli
snappymail
snipeit
tachyon
tinytinyrss
wallabag
wallos
wordpress-developer
wordpress-managed
xbackbone
yourls

Thanks, I was about to post the same list. Plus LAMP.

[jdaviescoates]

I've just installed Cloudron CLI and stopped all my PHP apps for good measure (with the help of Claude)

[p44]

@jdaviescoates Another “workaround” could be to install VPN app and mark as required to access to all installed application. What do you think? Could be a temporary workaround to avoid to stop every app?

[jdaviescoates]

@p44 I don't have the knowledge to know tbh. But it sounds a bit like what more qualified @fbartels described in that other thread.

[girish]

yes, limiting access via the VPN feature is a way to fix the issue.

To update: the base images are ready, our CI is at work pushing new packages.

[msbt]

@girish will/can there a patch for Cloudron <10 users? I have a LAMP which requires MYSQL 8.0, that's why I haven't upgraded to 9.2.0 yet, to avoid compatibility issues with MYSQL 8.4

Edit: Might opt for a custom app, that's not a healthy way to maintain that LAMP app

Unrelated: Great response time and effort for the fixes, much appreciated!

[maxkreg]

I powered off my netcup Cloudron servers a few hours ago and I´m now browsing through the forum, gathering info.
Would this be a sensible restart procedure, once cloudron and package updates are available?

• Before booting, restrict inbound access at the provider firewall to my IP only (SSH/HTTPS, covering IPv4 and IPv6), initially blocking other outbound traffic except administrative replies - if possible
• Boot normally and stop all apps through the dashboard.
• Allow the outbound connectivity needed for updates (no idea how..), verify/update Ubuntu’s ca-certificates, and install Cloudron 10.1.6 when available as laid out in @girish´s first post
• Update and test app packages individually once available, keeping unpatched apps stopped before restoring public access.

Would this make preventing Docker from starting during boot unnecessary? Also, is restricting inbound access sufficient for temporary operation, or should apps awaiting CA/runtime fixes remain stopped because of their outbound TLS connections?

Thank you guys being as fast and commited as you are

[sebastienserre]

How to receive the PHP fix ? I don't see any updates?
Do I need to stop my PHP apps ?

[jcaruso]

@sebastienserre Individual PHP apps will need to be updated. I just noticed that WordPress has been updated but others aren't yet. It sounds like the automated systems are still testing and building updates and they'll be ready soon.

[humpty]

@sebastienserre yes, it's best to stop the PHP-based apps. You can see which apps are affected a few posts up. App updates are being rolled out. For instance, Wordpress and Freescout fixes are ready. As for the server, go to the initial post, log in to your server(s) via SSH, and run the commands to make sure the server is up to date. That's all you need to do right now.

[jdbaker]

Yinz are true heroes!

[Teiluj]

@luckow said:

@jdaviescoates as fas as i know:
2fauth
...
yourls

Is there such list for Community apps also?

Thanks @staff and @all for the prompt community actions

[sebastienserre]

@humpty I followed steps on the server, it's up-to-date.
I run Cloudron 10.1.5, is a 10.1.6 will be released orno need it's per apps based ?

[humpty]

@sebastienserre 10.1.6 is needed and on the way. Stay tuned.

[girish]

The internal priority is to get the PHP apps updated first. The PHP issue is far more severe than the certificate issue (which requires the DNS or something else to be compromised to work). In that sense, 10.1.6 will happen but after most of the PHP apps are updated.