Handling Identified Security Vulnerabilities

Overview

Your security specialist has run a Security Scan against your environment and has provided you with several identified vulnerabilities. You want to take steps to address these but are uncertain which packages are related to Xinet and which can be safely disabled or updated.

When receiving reports of security vulnerabilities from your security specialist, these often appear as Common Vulnerability and Exposure (CVE) record codes in the form CVE-1234-5678. These identifiers are linked to descriptions within the CVE List for the publicly reported vulnerability for a particular software package. Many security audit tools and providers will also include suggested remediations steps, such as updating the package.

Solution

As new releases of Xinet are published, they will often include fixes to security concerns that have been identified from past releases. As such, it is suggested that you take steps to Upgrade Xinet to the latest release whenever possible.

In many cases, the reported vulnerabilities can be traced back to 3rd-party packages used by Xinet or pre-installed on the Host OS. While many dependencies can be updated separately from Xinet, if there are any libraries within Xinet that will require a code change, our Development Team will handle this request as a Product Enhancement.

If there is a Xinet component or a 3rd-Party package reported in the Security Audit that is not included within the table below, please submit a Support Ticket.

<supportagent>

If a customer reports a security vulnerability, reference the steps within Troubleshooting Article: Security Vulnerabilities to help isolate and mitigate the impact.

</supportagent>

Known Safe Upgrade Paths for Commonly Reported 3rd-Party Package

Below, we have detailed a number of the most common 3rd-party packages included within reports that we have received and any remediation steps that you can safely take.