Resolving System Vulnerabilities by Upgrading to RHEL 8.10

Information

Issue: Multiple vulnerabilities reported on systems running MGR version R04.14.10.01.

Resolution Steps:

1. Upgrade to RHEL 8.10:
   • Ensure all components (MGR, AMS, FAF, HUB, LGP, PBC, RTR, etc.) are upgraded to the latest versions available.
   • Follow your standard upgrade procedures to install RHEL 8.10.
2. Post-Upgrade Checks:
   • SSH Version and Key Exchange:
     • Run ssh -V to verify OpenSSH version is 9.6+.
     • Execute ssh -Q kex | grep sntrup to ensure sntrup761x25519-sha512@openssh.com is supported.
   • Log4j Library Check:
     • If using the LGR component, run find / -type f -name "log4j*.jar" -exec ls -lh {} \; 2>/dev/null.
     • Replace or upgrade any Log4j 1.x files found.
   • SSL/TLS Certificate Validation:
     • Use echo | openssl s_client -connect <host>:443 2>/dev/null | openssl x509 -noout -enddate to check certificate expiration.
     • Ensure certificates are valid and issued by a trusted CA.
   • TLS Protocol Support:
     • Run the following to check supported protocols:

       for v in ssl3 tls1 tls1_1 tls1_2 tls1_3; do
         echo -n "$v: "
         echo | openssl s_client -connect <host>:443 -$v </dev/null 2>&1 | grep "Protocol" || echo "Not supported"
       done

     • Only TLS 1.2 and TLS 1.3 should be enabled.
   • Cipher Suite Validation:
     • Test with echo | openssl s_client -connect <host>:443 -cipher 'RC4-SHA' 2>&1 | head -n20.
     • Ensure connections fail for insecure ciphers.

Note: If compatibility issues arise with the upgrade, consult with management to decide whether to proceed with the upgrade or accept the risk of existing vulnerabilities.