As a software publisher, we care about the security of the software we offer and make continuous updates as security vulnerabilities or potential issues are discovered or reported to us via the security@centreon.com address, through our Customer Care service The Guard or here on The Watch. Note that a page describes our security policy and we also have the process to report a vulnerability.
However, even if your Centreon applications are up-to-date, it is important to follow best practices to keep the Operating Systems on which they run secure, as well as the third-party components running on these systems.
We recommend applying security updates as soon as they are available (and restarting the affected services afterwards; if in doubt, system reboot is also possible).
This article is aimed at providing some tips to do so if you are not familiar with Linux systems maintenance.
Automatic update tools:
There are tools such as dnf-automatic (for RHEL-like systems) or unattended-upgrades (for Debian) that can apply security updates automatically:
https://dnf.readthedocs.io/en/latest/automatic.html
https://wiki.debian.org/UnattendedUpgrades
Example of a targeted update:
If you are aware of a specific Common Vulnerabilities and Exposures (CVE) and its identifier, it is possible to directly check on your system if it is properly resolved.
Here is an example of a process you can use for the CVE-2022-1292 affecting OpenSSL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1292
AlmaLinux:
If you are on AlmaLinux 8, a search will take you to this page: https://errata.almalinux.org/8/ALSA-2022-5818.html which references the vulnerability (as it has been fixed upstream by RedHat): https://access.redhat.com/security/cve/CVE-2022-1292.
You can also read the "changelogs" from the system itself, with this command for example: rpm -q -changelog followed by the name of the library or program concerned with a grep on the CVE ID:
rpm -q -changelog openssl |grep CVE-2022-1292
- Fix CVE-2022-1292: openssl: c_rehash script allows command injection
Debian:
If you are on Debian 11 Bullseye, a search will take you to this page: https://security-tracker.debian.org/tracker/CVE-2022-1292.
From the system, you can search directly in the changelogs with grep, which will confirm that it is properly fixed:
zgrep CVE-2022-1292 /usr/share/doc/openssl/changelog.*
/usr/share/doc/openssl/changelog.Debian.gz: - CVE-2022-1292 (The c_rehash script allows command injection).
/usr/share/doc/openssl/changelog.gz: CVE-2022-1292, further bugs where the c_rehash script does not
/usr/share/doc/openssl/changelog.gz: When the CVE-2022-1292 was fixed it was not discovered that there
/usr/share/doc/openssl/changelog.gz: (CVE-2022-1292)