Security issue thread - PHP and eMudhra cert compromise

[Benoit]

Thanks for your work @girish . Do you know if a fix is on the way for Moodle ?

[jdaviescoates]

@p44 said:

WordPress (Developer) 7.0
Package version
org.wordpress.unmanaged.cloudronapp@4.0.0

You're suffering from something that got me (and others) too - that 4.0.0 release was a mistake. You need to force the update the the newer version with a lower release number using the CLI:

cloudron update --app SITE_LOCATION --appstore-id org.wordpress.unmanaged.cloudronapp --force

[p44]

@jdaviescoates Thanks a lot, how I can run this without installing Cloudron CLI? Eg. directly from App command line.

I think if this problem is on scale, devs should release a fix also to address this specific issue...

Edit:

@jdaviescoates I installed Cloudron CLI and I used this string that you posted above:

for a in $(cloudron list | awk '$5=="stopped" && $3=="org.wordpress.unmanaged.cloudronapp@4.0.0" {print $1}'); do cloudron start --app "$a" && cloudron update --app "$a" --appstore-id org.wordpress.unmanaged.cloudronapp@3.17.0 --force; done

[joseph]

@p44 yes, there is a fix in https://git.cloudron.io/platform/box/-/commit/a213f095d15c060959a904516ddb0c22d6c0f3d7 for this in 10.1.6 .

[p44]

This post is deleted!

[whitespace]

Wallabag and Castopod haven't been updated in a while.

Here is a Wallabag thread. It seems they are 1 year behind in codebase updates. (??) But there is a compatibility-frinedly fix being tested.
https://github.com/wallabag/wallabag/pull/9096

Castopod released an update a few hours ago on their official code:
https://github.com/ad-aures/castopod/releases/tag/v1.15.6

[humpty]

Invoice Ninja v5.13.50 is out, but I'm not sure if it has the php fixes. In any case, please update the package!

https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.50

[Tphane]

@girish
Hi
About this Gitlab flaw does it impact security concerns about Cloudron instances ?
Is it better to wait before doing app updates in our Cloudron instances ?
Cloudron uses Gitlab for its developpment and for pushing new updates ?

[nebulon]

The new gitlab package with the fix is already out now. So please update that

[sebastienserre]

any news about the Dolibarr package ?

[nebulon]

it is also in our pipeline, will come soon, everything is stacking up a but on our CI infra, esp with the GitLab update coming in between

[karlemilnikka]

@nebulon Any chance Castopod will be updated within the next couple of hours?

[daebak]

Hi everyone,

Regarding this security issue thread and the discussion around PHP/eMudhra certs and apps like GitLab, I wanted to ask:

1. Is Nextcloud on Cloudron affected by this risk in any way?
2. Will a package update be required for Nextcloud instances to address this, or is no action needed on our side?

Thanks for clarifying!

[timconsidine]

@daebak see https://forum.cloudron.io/post/131604

[jdaviescoates]

@timconsidine said:

@daebak see https://forum.cloudron.io/post/131604

But in short: yes, update your Nextcloud ASAP. The update is already out.

[nebulon]

@sebastienserre dolibarr package is out now

[daebak]

@timconsidine thanks

[karlemilnikka]

karlemilnikka said:

@nebulon Any chance Castopod will be updated within the next couple of hours?

It looks like there’s a patched version of Castopod available, though not yet available in Cloudron.

[nebulon]

yes that has some bug though and needed source code changes, so we have deferred that until we catch up with the other ones and have time to look into some upstream patch.

[karlemilnikka]

@nebulon I see, so we shouldn’t expect being able to take Castopod online for a couple of days (i.e., best to migrate away)?