Software-update: Sophos XG Firewall 17.5 MR12 / 18.0 GA-Build379

Sophos heeft nieuwe versies vrijgegeven van zijn XG Firewall met 17.5 MR12 en 18.0 GA-Build379 als versienummers. Deze software wordt zowel op fysieke hardware als in een soft-appliance voor VMware, Hyper-V, Xen en KVM geleverd. Naast de betaalde varianten voor bedrijven biedt Sophos deze firewall voor thuisgebruik zonder kosten aan, zoals op deze pagina te lezen is. Voor de verschillende image- en updatebestanden kun je terecht op het MySophos-portaal. De aankondigingen van deze uitgaves zien er als volgt uit:

XG Firewall 17.5 MR12 Released

Hi XG Community!

We've released XG Firewall 17.5 MR12. Initially, the firmware will be available by manual download from the Licensing Portal. We will gradually release the firmware via auto-update to customers.

Note: The upgrade from version 17.5 MR12 to 18.0 will follow soon.

News

• Security Release
• Fixes SQL injection vulnerability and malicious code execution in XG Firewall/SFOS detailed out in KBA135412

Note: Hotfix referenced in KBA135412 is NOT required for 17.5 MR12 as CVE-2020-12271 has been fixed in this release version.

Issues Resolved

• NC-59408 [API Framework, UI Framework] SQLi prevention in hybrid request - ORM fields and mode parameters (CVE-2020-12271)
• NC-58898 [Email] Potential RCE through heap overflow in awarrensmtp (CVE-2020-11503)
• NC-59300 [Email] Blind pre-auth SQLi in spxd on port 8094
• NC-59454 [UI Framework] Enable apache access logs

XG Firewall 18.0 GA-Build379 Released

Hi XG Community!

We've released XG Firewall 18.0 GA-Build379. Initially, the firmware will be available by manual download from the Licensing Portal. We will gradually release the firmware via auto-update to customers.

Security Release

• Fixes SQL injection vulnerability and malicious code execution in XG Firewall/SFOS detailed out in KBA135412

Important note

• This is a security release for v18 GA; incremental to the previous GA release 18.0 GA-Build354
• We will soon have a re-release of v18 MR1 to support SD-RED devices and upgrade from v17.5 MR11/ MR12
• You can upgrade from SFOS 17.5 (MR6 to MR10) to this release 18.0 GA-Build379
• Hotfix referenced in KBA135412 is NOT required for 18.0 GA-Build379 as CVE-2020-12271 has been fixed in this release version

Issues Resolved in XG Firewall 18.0 GA-Build379

• NC-59408 [API Framework, UI Framework] SQLi prevention in hybrid request - ORM fields and mode parameters (CVE-2020-12271)
• NC-58898 [Email] Potential RCE through heap overflow in awarrensmtp (CVE-2020-11503)
• NC-59300 [Email] Blind pre-auth SQLi in spxd on port 8094
• NC-59454 [UI Framework] Enable apache access logs

Versienummer	17.5 MR12 / 18.0 GA-Build379
Releasestatus	Final
Website	Sophos
Download	https://www.sophos.com/en-us/mysophos
Licentietype	Freeware/Betaald