Security issue thread - PHP and eMudhra cert compromise

[sebastienserre]

any news about the Dolibarr package ?

[nebulon]

it is also in our pipeline, will come soon, everything is stacking up a but on our CI infra, esp with the GitLab update coming in between

[karlemilnikka]

@nebulon Any chance Castopod will be updated within the next couple of hours?

[daebak]

Hi everyone,

Regarding this security issue thread and the discussion around PHP/eMudhra certs and apps like GitLab, I wanted to ask:

1. Is Nextcloud on Cloudron affected by this risk in any way?
2. Will a package update be required for Nextcloud instances to address this, or is no action needed on our side?

Thanks for clarifying!

[timconsidine]

@daebak see https://forum.cloudron.io/post/131604

[jdaviescoates]

@timconsidine said:

@daebak see https://forum.cloudron.io/post/131604

But in short: yes, update your Nextcloud ASAP. The update is already out.

[nebulon]

@sebastienserre dolibarr package is out now

[daebak]

@timconsidine thanks

[karlemilnikka]

karlemilnikka said:

@nebulon Any chance Castopod will be updated within the next couple of hours?

It looks like there’s a patched version of Castopod available, though not yet available in Cloudron.

[nebulon]

yes that has some bug though and needed source code changes, so we have deferred that until we catch up with the other ones and have time to look into some upstream patch.

[karlemilnikka]

@nebulon I see, so we shouldn’t expect being able to take Castopod online for a couple of days (i.e., best to migrate away)?

[nebulon]

might be too early to recommend migrating away, I think a lot of projects struggle currently to keep up simply.

[karlemilnikka]

@nebulon I understand, but after 24 h of downtime and no ETA, it seems like the best choice. Thanks for the quick replies!

[karlemilnikka]

@nebulon Oh, and thanks for the amazing job you and your colleagues have done with many of the other packages!

[timconsidine]

Any thoughts on vulnerabilities allegedly in python and samba ?
https://x.com/markgadala/status/2113385154458583370?s=46

I wrote “allegedly” as I don’t have confirmation.

[humpty]

@timconsidine why does it feel like this is the new norm now because of AI?

[bazinga]

I really hope cloudron team focuses their efforts on running all kinds of AI driven security testing against the platform. Otherwise very soon we may see more serious issues.

[CRBear]

I’d like to take this opportunity to express my sincere appreciation and say a huge thank you for the excellent and highly professional work, particularly in addressing the issues discussed in this thread.

[daebak]

@CRBear You're absolutely right, we're all very concerned about our systems and sometimes we forget about those who work promptly to resolve them. I join you in your thanks, and special thanks as well to the other members who often contribute with valuable answers.

[whitespace]

@bazinga If anything their efforts are already focused on keeping Cloudron secure, which is one of the reasons it exists in the first place. To say "hopefully they will use AI or else" is kinda disrespectful to the project, don't you think? I see where you are coming from though. We live in exponential times.