PHP CVE Patching

No.

five character minimum

I’m not sure if anyone was saying it is the same. But the importance of always staying up to date on any security patches is just as important regardless of any server’s implementation technique.

A FreePBX with a firewall between it and the Internet could be configured to only allow whitelisted subnets for SIP registrations, UCP access, admin site access, API access, etc. Which could provide a false sense of security. Since only company networks have any meaningful path to FreePBX. The problem is always lateral movement. If any client machine on those same company networks is compromised then it basically has the same path available to FreePBX by a bad actor.

Like Windows admins with EOL Windows Servers on their networks. Just because the servers aren’t directly accessible via the Internet at-large, any local user machine that’s compromised opens the door just the same.

I upgraded all my Freepbx 17 and Freepbx 16 successfully.

I happened to run fwconsole ma upgradeall while patching and I have had quite a few people tell me odd things are happening. They have said parked/transfer calls just disappear, when they intercom it just connects now, no beeping before, random BLF issues.

Has anyone experienced these issues since updating? This has only been Freepbx 17 users who have complained. Freepbx 16 I have had no complaints.

FreePBX 17 (fully updated) and Asterisk 22.11.0

Hello,

Thank you for the procedure. I have a couple of internal F16 boxes running, and this process did upgrade us to PHP 7.4.33 as expected. Restarting httpd, which should have uploaded / refreshed php, resulted in weird GUI movements - I couldn’t bring up the dashboard, and the backup jobs were missing from the backup/restore module. I didn’t extensively check - I restarted the box, and that cleaned up the GUI and all.

Thanks!

Christian

Question -

With the procedure of installing sangoma-devel16, what other possible modules are now exposed to the systems? I am afraid that a ā€œyum updateā€ might bring along beta software on other modules that are not desired.

Yes, I need to motivate the customer to allow me to update them to F17, but in the meantime, not knowing what other software is in devel1l6, I’ll need to avoid ā€œyum updateā€.

I thank Sangoma for providing this resource, but also wish to avoid conflicts if there are other packages in that library that I don’t need.

Christian

I haven’t ran into any issues with Freepbx 16.I just followed the PHP upgrade steps. Freepbx 17 updates have changed or introduced something though. Have people complaining this morning.

With the OS EOL I don’t think yum upgrade did much except upgrade the PHP. Take a backup or snapshot just in case though?

Disregard my posts, I had a bad custom extensions routing loop. all is well now!

That’s interesting, since Asterisk 18.26.4 is a year old at this point and the 18.26.0 it is originally based on is almost 2 years old so that wouldn’t be a recent regression in Asterisk with a memory leak.

That’s a good question! I don’t know. It depends on the private details of your environment, which even if I did know, I would never share in this forum publicly. :wink:

But, assuming a standard install, with fully up-to-date FreePBX modules and all other distribution/system packages, on either v16 or v17 (the currently supported versions of FreePBX), this PHP update passes our QA testing.

Are you able to try the update from the CLI instead of the GUI ? Then reboot the system ?

Thanx for the port! One more FreePBX v16 up to date with PHP 7.4.33 and working fine.