This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

Go to solution
RonaldW
New Contributor II

2 weeks ago

Hi Extreme Community,

Following the critical PHP security vulnerability as reported today by the UK NCSC, we would like to understand the potential impact on XIQ-Site Engine (XIQ-SE) and ExtremeControl.

Reference: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Could Extreme Networks clarify the following?

  1. Are XIQ-Site Engine and ExtremeControl affected by this vulnerability?
  2. If affected, is Extreme planning to release a security update or hotfix to address it?
  3. Is it possible and officially supported to patch or upgrade PHP independently on XIQ-Site Engine and ExtremeControl, without waiting for a full product update?

We would particularly appreciate guidance on whether manually updating PHP could affect product functionality or support eligibility.

Thanks in advance for any clarification or recommendations.

Best regards,

Ronald

- Ronald
2 ACCEPTED SOLUTIONS
12 REPLIES 12

Go to solution
Paul99
New Contributor II

a week ago

Hi everyone,

Has anyone already installed the field patch on a version lower than the one specified in the article as having been tested? Or even on the version that was tested, and can report whether any problems have occurred?

Is anyone waiting for the November release, which will include the updated binaries, rather than installing the packages manually right now?

0 Kudos

Go to solution
Jordan
New Contributor II
In response to Paul99

a week ago

For most of my customers we've deployed the patch for the Extreme Control Engines without issue with them being on various different versions. The oldest version patched was 24.10.13.5 (with them to upgrade to latest code in due course).






0 Kudos

Go to solution
Robert_Haynes
Extreme Employee
In response to Jordan

a week ago

On that note (the upgrade in due course) please let this be an action item / reminder to our customers that Extreme supports the last 12 months of software releases for ExtremeCloud IQ - Site Engine, Control, Analytics. If you find your customers are on a release before ~ 25.11.10 at this point you should also work with them to ensure they upgrade to a supported release stream.

26.02.13 and 26.08.xx are recommended branches. That or wait for 26.11.10 so they can both upgrade and obtain the PHP patches in one go.

Thank you.

0 Kudos

Go to solution
Paul99
New Contributor II
In response to Robert_Haynes

a week ago

Hi Jordan and Robert,

Thanks for your feedback.

I’m glad to hear that the field patch worked without any issues on the customer systems.

@Robert_Haynes 

Thanks for the note about the software versions. For my part, I can say that the system is currently running on the recommended version listed on your website.

But it’s still important to remind people to pay attention to the version they’re running, especially when it comes to potential support from your team.

We’ll definitely take a look at version 26.11.10 in November, as well as the Field Patch itself.

 

If anyone else has had experience with the Field Patch, please feel free to share.

 

Best regards

Paul

GTM-P2G8KFN