Skip to content

v17.43 - crashes, trusted list, share files; rules 2026-10-28e

Latest
Latest

Choose a tag to compare

View all tags
@JensMiltenberger JensMiltenberger released this 28 Oct 13:56
· 1 commit to main since this release
v17.43
c10fc54

Second release after v17.29. Script 17.43, rules stand 2026-10-28e.

Correction first. Rules stands 2026-10-23 and 2026-10-27 carried wrong fix builds for CTX697263 (PHP2Shell): 14.1-73.41 and 13.1-64.28, which belong to the SAML bulletin. Citrix published the real remediation versions on 2026-10-27: 14.1-73.49, 13.1-64.32, 14.1-FIPS 73.49, 13.1-FIPS/NDcPP 37.286. Appliances between 73.41 and 73.46 were reported as fixed although they are vulnerable. Replace the rules file; details in docs/releases/rules-2026-10-28.md. The rules format now has pending for “advisory out, no fixed build yet”, so this cannot repeat.

Since v17.29

  • CTX697263 (PHP2Shell): build check, management portal ACL check, PHP memory and fatal patterns in admin_ui, Apache worker crashes.
  • Crashes as events: Pitboss, kernel, Apache error log and /var/core (files and directories), one event per process and PID with signal, restart counter and core; every crash at least yellow, red for nsaaad on a SAML gateway twice a day, httpd on a vulnerable build, nsppe with DTLS errors, repetition within a day or across days, or a request from outside in the 120 seconds before. Verified on a lab appliance with real kill -SEGV; boot aftermath directories are INFO.
  • No more self-hits: nsprofmon CPU snapshots are set aside; identical lines from ns.log and messages count once.
  • Trusted list ns_quickcheck.trusted_ips with expiry: scanners and pentesters appear as [TRUST] without affecting the verdict; effect findings stay red.
  • Anonymized address lists and a share file per run for a corroborated address feed (two independent appliances before publication).
  • Whitelist with three rule forms and hash pins (--pin, --pin-all); directory rules no longer cover code and are not recommended.
  • Anonymizer: report words and short accounts are never mapped; host names from config URLs and NT/DNS domains are.
  • Report footer, vuln_open, trusted_seen, crashes in the result line; release notes per version under docs/releases/.

Assets
ns_quickcheck.sh SHA-256 15bcf2ef7ba1916b8fc33d8868b7cf4999cf014dd02425f929920fce954db0be,
ns_quickcheck.rules SHA-256 b8ea6f58168ed41f00829c527790aa22ae5358ccded5ffdfd8dc06542a8c5e4d.

Validated on 14.1-73.41, 73.46 and 73.49 (lab and customer gateways); 13.1 and FIPS remain beta. Output language is German, documentation in both languages.

Assets 2
Loading