devel

Download

devel@lists.apertis.org

April 2024

2 participants
2 discussions

Scheduled Maintenance for Apertis Cluster on Tuesday, April 30th at 10:00 CEST
by Juan Pablo Vigo Mas 30 Apr '24

30 Apr '24

Dear Apertis Users, We would like to inform you that scheduled maintenance is planned for our Apertis cluster on Tuesday, April 30th, starting at 10:00 CEST. During this maintenance window, we will be performing essential updates of aptly and Traefik to ensure the stability and performance of the cluster. Please note the following details: Date: Tuesday, April 30th, 2024 Time: 10:00 CEST Duration: Maintenance is expected to last approximately 30 min Impact: During the maintenance window, access to the Apertis cluster may be temporarily unavailable or degraded. We apologize for any inconvenience this may cause and appreciate your patience and understanding. If you have any urgent concerns or questions regarding this maintenance, please feel free to contact us. Thank you for your cooperation. Best regards, Apertis DevOps Team

1 1

No Apertis releases affected by the xz/liblzma exploit
by Walter Lozano 02 Apr '24

02 Apr '24

As part of the baseline work, the Apertis core team monitors security issues and updates. On March 28, 2024, a backdoor in upstream xz/liblzma project [1] has been found compromising ssh servers. This issue was first introduced in a stable xz-utils release since 5.6.0 which is found in Debian experimental, Debian Testing, and Debian Unstable. However, none of the Apertis releases are affected. The current Apertis 2024.0, which was just released, is based on Debian 12 (Bookworm). Neither Debian Bookworm or Apertis 2024.0 were affected. They rely on a previous version of the xz/liblzma project. For reference, the version the xz/liblzma project (xz-utils) included in the latest Apertis release is based on: 5.4.1-0.2. Even if this issue is not affecting Apertis, the impact serves as an important reminder about the importance of following best practices regarding security reports and updates. Regards, Walter [1] https://nvd.nist.gov/vuln/detail/CVE-2024-3094 -- Walter Lozano Collabora Ltd.

1 0