January 5, 2023: Security vulnerability update and FAQ

RE: January 5, 2023: Security vulnerability update and FAQ

Logamurugan Pilavadi — Mon, 16 Jan 2023 13:23:50 GMT

Why is there a difference between patch to be applied on .htaccess and install_utils.php? Patch required for install_utils.php missing / and log4php in the pattern

RE: January 5, 2023: Security vulnerability update and FAQ

Club Concierge — Fri, 13 Jan 2023 20:32:27 GMT

This post has been updated to reflect the current status of SugarCRM’s actions and knowledge. Updates include updated instructions based on the release of the 12.0.2 and 11.0.5 patches, information regarding the official CVE report, and additional instructions on how to locate possible evidence to help determine if you have been affected.

RE: January 5, 2023: Security vulnerability update and FAQ

Junaid Usman — Fri, 13 Jan 2023 14:52:38 GMT

Thanks for the quick patch.

It is very unfortunate that an official statement from the SugarCRM side came on the 4th of Jan while the vulnerability was announced on the 28th of December. Considering this is a 0-day Auth bypass, it would have been better if the announcement was made as soon as it is public; so that customers can take some precautionary measures while waiting for a quick patch.

RE: January 5, 2023: Security vulnerability update and FAQ

Francesca Shiekh — Fri, 13 Jan 2023 01:52:36 GMT

For those still on Professional, the upgrade to 11.0.5 brings back Bug 87739 and shows up as a database mismatch for fields of type INT.

RE: January 5, 2023: Security vulnerability update and FAQ

Club Concierge — Tue, 10 Jan 2023 00:40:24 GMT

This post has been updated to reflect findings related to instances of Sugar where SugarIdentity is enabled. We have determined that the vulnerability could not impact instances that had SugarIdentity enabled. For help in determining if SugarIdentity was enabled on your instance, instructions can be found here.

RE: January 5, 2023: Security vulnerability update and FAQ

Club Concierge — Fri, 06 Jan 2023 18:45:45 GMT

Additional questions added:

Please click the "Turn Comment notifications on" button on this post to be notified of any updates