PHP vuln and cnMaestro?

Products cnMaestro
1

Just checking if cnMaestro is affected, and if there will be a patch soon?

2

the onprem / self-hosted cnMaestro does not appear to run PHP:

root@cnmaestro:~# ps aux | grep php
root     3673093  0.0  0.0   6544  2412 pts/1    S+   23:56   0:00 grep --color=auto php

And indeed, PHP doesn’t seem to be installed in the VM image at all:

root@cnmaestro:~# apt list --installed | grep php

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

root@cnmaestro:~#

Ubiquiti UISP does use PHP though (it’s inside a docker container), and hasn’t been updated yet.

I don’t know about Ubiquiti’s Unifi controller or whatever the heck they’re calling it now though.

3

Thanks for checking.

I will have to go back into console. Ubuntu can be updated. There are quite a few vulns out in the wild. Root cert vulns etc. Perhaps I should lock it down even more while I get more info in the language used.

As for Ubiquiti, the Unifi controller was running Java but can’t get myself to touch that crap anymore. IMO, they’re the most likely to get owned.

Go, rust, Quic and lots of other vulns out there.