About lychiang

Symptoms Expedition is vulnerable to CVE-2022-37026, below are the Detail about the vulnerability : In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.   Diagnosis Issue below command in Expedition CLI: $apt list --installed | grep erlang  the result will show erlang package is v22.x which is vulnerable to the CVE   Solution Summary: Run below commands in Expedition CLI to add new repositories and upgrade the two packages to the stated version:   rabbitmq-server: 3.11.4-1 erlang: 25.0.4   ------------------------------------------------------------------------------------- $sudo -su root $service mysql stop $apt-get remove rabbitmq-server && apt-get purge rabbitmq-server $apt-get remove erlang && apt-get purge erlang $apt autoremove $apt install wget $wget -O- https://packages.erlang-solutions.com/ubuntu/erlang_solutions.asc | sudo apt-key add - $echo "deb https://packages.erlang-solutions.com/ubuntu focal contrib" | sudo tee /etc/apt/sources.list.d/erlang-solution.list $curl -s https://packagecloud.io/install/repositories/rabbitmq/rabbitmq-server/script.deb.sh | sudo bash $apt-get install rabbitmq-server=3.11.4-1 $apt autoremove $apt purge $service mysql start   Verify the two packages are updated with the required version with below commands:   $apt list --installed | grep erlang  $apt list --installed | grep rabbitmq-server       ... View more