topic Re: XIQ-SE components in ExtremeCloud IQ- Site Engine Management Center

XIQ-SE components

EF — Wed, 12 Oct 2022 11:07:06 GMT

Hi Team,

as XIQ-SE is composed for a set of different tools, and applications built in or in its engines, I would like to ask if there is a document about all of them, used releases, patchs, etc...

My problem is that XIQ-SE is being analyzed for a security team with pentesting tools, and they request info about security holes in their diferents components.

Best!!!

Re: XIQ-SE components

Robert_Haynes — Wed, 12 Oct 2022 12:35:20 GMT

Hello.

I am not certain what you are asking for.

If you have a vendor performing penetration / vulnerability exposure testing against XIQ-SE and any portfolio product, they should treat the appliances as a black box and perform such scans.

Please elaborate on "request about security holes"? I would not imagine we'd publish a document that outlines security holes in our products.

As for what we have found and fixed in prior releases please refer to release notes and the vulnerabilities remediated sections within. You will see various mentions to CVE and other vulnerability bulletin id's, etc.

Re: XIQ-SE components

Ryan_Yacobucci — Wed, 12 Oct 2022 12:40:04 GMT

Hello,

QA regularly uses well known security testing tools to scan the different XIQ-SE components to identify vulnerabilities of both Extreme Proprietary software and 3rd party applications used in the suite. These vulnerabilities are regularly patched in maintenance releases.

Information on Vulnerabilities that have been patched can be found in the release notes under the "Vulnerabilities Addresses" section.

https://documentation.extremenetworks.com/release_notes/NetSight/XIQSE/XIQSE_22.6.13_Release_Notes.pdf?_ga=2.131350863.1188659776.1665578103-1461443537.1656515490

Thanks

-Ryan

Re: XIQ-SE components

Zdeněk_Pala — Wed, 12 Oct 2022 13:07:32 GMT

Hi EF.

we do not publish this information publicly. You can get 3rd party licenses used in the product:/usr/local/Extreme_Networks/NetSight/ThirdPartyLicenses_*.zip

We are working on updating the Open Software Declaration. = https://www.extremenetworks.com/support/policies/open-source-declaration/