remediating vulnerabilities

[rodill]

My scanning team keeps finding vulnerabilities on Expedition and keep requesting I patch them. They all seem to be related to Linux not Expedition itself. I know that I can't upgrade the version of Ubuntu that it runs on. Suggestions? 

list of some of the vulnerabilities

Apache

CVE-2017-15715

CVE-2016-8743

CVE-2019-0211

CVE-2018-1333

CVE-2016-2161

CVE-2016-8740

CVE-2016-5387

CVE-2017-15710

CVE-2016-0736

CVE-2018-1303

CVE-2016-4979

CVE-2017-9798

CVE-2019-0217

CVE-2018-17199

[azuniga]

Hello @rodill,

You are not supposed to run any upgrade on the Ubuntu image that is why I did not include that in my commands, it will break the expedition parser.

[rodill]

so that worked on one of my expedition boxes, but when I try to upgrade the other I get error after apt upgrade

Err:1 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 python3-gdbm amd64 3.6.5-3~16.04.york4
403 Forbidden [IP: 91.189.95.85 80]
E: Failed to fetch http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu/pool/main/p/python3-stdlib-extensions/python3-g... 403 Forbidden [IP: 91.189.95.85 80]

E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

suggestions?

[azuniga]

Hello @rodill 

Can you run another update and tee the output log file so I can view it in it's entirety?

sudo apt-get update | tee update.log

[rodill]

expedition@Expedition:~$ sudo apt-get update | tee update.log
[sudo] password for expedition:
Hit:2 http://us.archive.ubuntu.com/ubuntu xenial InRelease
Get:3 http://us.archive.ubuntu.com/ubuntu xenial-updates InRelease [109 kB]
Hit:4 http://sgp1.mirrors.digitalocean.com/mariadb/repo/10.1/ubuntu xenial InRelease
Ign:1 https://www.rabbitmq.com/debian testing InRelease
Ign:6 https://conversionupdates.paloaltonetworks.com expedition-updates/ InRelease
Get:7 http://us.archive.ubuntu.com/ubuntu xenial-backports InRelease [107 kB]
Get:8 http://security.ubuntu.com/ubuntu xenial-security InRelease [109 kB]
Hit:9 http://ppa.launchpad.net/adiscon/v8-stable/ubuntu xenial InRelease
Ign:5 https://www.rabbitmq.com/debian testing Release
Ign:15 https://conversionupdates.paloaltonetworks.com expedition-updates/ Release
Ign:10 https://www.rabbitmq.com/debian testing/main amd64 Packages.diff/Index
Hit:16 http://ppa.launchpad.net/deadsnakes/ppa/ubuntu xenial InRelease
Ign:11 https://www.rabbitmq.com/debian testing/main i386 Packages.diff/Index
Ign:19 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages.diff/Index
Ign:20 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial InRelease
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Get:22 http://ppa.launchpad.net/ondrej/apache2/ubuntu xenial InRelease [23.8 kB]
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:24 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial Release
Ign:25 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:26 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages.diff/Index
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:27 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages.diff/Index
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
Ign:28 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main all Packages
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:25 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:29 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en_US
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Ign:30 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en.diff/Index
Ign:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:31 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:25 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages
Ign:32 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Ign:28 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main all Packages
Ign:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:29 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en_US
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Hit:25 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages
Ign:33 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Ign:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Ign:31 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:32 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:28 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main all Packages
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Err:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
404 OK
Ign:29 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en_US
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:33 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en
Ign:31 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages
Ign:32 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages
Ign:28 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main all Packages
Ign:29 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en_US
Ign:33 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en
Ign:31 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages
Ign:32 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages
Ign:28 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main all Packages
Ign:29 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en_US
Ign:33 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en
Ign:31 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages
Ign:32 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages
Ign:28 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main all Packages
Ign:29 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en_US
Ign:33 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en
Err:31 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages
403 Forbidden [IP: 91.189.95.85 80]
Ign:32 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages
Ign:33 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en
Fetched 349 kB in 8s (41.8 kB/s)
Reading package lists...
W: The repository 'http://www.rabbitmq.com/debian testing Release' does not have a Release file.
W: The repository 'https://conversionupdates.paloaltonetworks.com expedition-updates/ Release' does not have a Release file.
W: The repository 'http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial Release' does not have a Release file.
E: Failed to fetch https://www.rabbitmq.com/debian/dists/testing/main/binary-amd64/Packages 404 OK
E: Failed to fetch http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu/dists/xenial/main/binary-amd64/Packages 403 Forbidden [IP: 91.189.95.85 80]
E: Some index files failed to download. They have been ignored, or old ones used instead.

[rodill]

expedition@Expedition:~$ sudo apt-get update | tee update.log
[sudo] password for expedition:
Hit:2 http://us.archive.ubuntu.com/ubuntu xenial InRelease
Get:3 http://us.archive.ubuntu.com/ubuntu xenial-updates InRelease [109 kB]
Hit:4 http://sgp1.mirrors.digitalocean.com/mariadb/repo/10.1/ubuntu xenial InRelease
Ign:1 https://www.rabbitmq.com/debian testing InRelease
Ign:6 https://conversionupdates.paloaltonetworks.com expedition-updates/ InRelease
Get:7 http://us.archive.ubuntu.com/ubuntu xenial-backports InRelease [107 kB]
Get:8 http://security.ubuntu.com/ubuntu xenial-security InRelease [109 kB]
Hit:9 http://ppa.launchpad.net/adiscon/v8-stable/ubuntu xenial InRelease
Ign:5 https://www.rabbitmq.com/debian testing Release
Ign:15 https://conversionupdates.paloaltonetworks.com expedition-updates/ Release
Ign:10 https://www.rabbitmq.com/debian testing/main amd64 Packages.diff/Index
Hit:16 http://ppa.launchpad.net/deadsnakes/ppa/ubuntu xenial InRelease
Ign:11 https://www.rabbitmq.com/debian testing/main i386 Packages.diff/Index
Ign:19 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages.diff/Index
Ign:20 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial InRelease
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Get:22 http://ppa.launchpad.net/ondrej/apache2/ubuntu xenial InRelease [23.8 kB]
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:24 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial Release
Ign:25 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:26 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 Packages.diff/Index
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:27 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main i386 Packages.diff/Index
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en
Ign:23 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en
Ign:17 https://www.rabbitmq.com/debian testing/main amd64 Packages
Ign:28 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main all Packages
Ign:18 https://www.rabbitmq.com/debian testing/main i386 Packages
Ign:25 https://conversionupdates.paloaltonetworks.com expedition-updates/ Packages
Ign:12 https://www.rabbitmq.com/debian testing/main all Packages
Ign:29 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main Translation-en_US
Ign:13 https://www.rabbitmq.com/debian testing/main Translation-en_US
Ign:21 https://conversionupdates.paloaltonetworks.com expedition-updates/ Translation-en_US
Ign:14 https://www.rabbitmq.com/debian testing/main Translation-en