topic Re: Cloudguard WAF - Appsec Gateway - CVE-2024-6387 in WAF

Cloudguard WAF - Appsec Gateway - CVE-2024-6387

Napoji — Mon, 10 Feb 2025 16:42:41 GMT

Dear All,

Currently the Appsec Gateway for VMware run OpenSSH version 7.8 and customer asked will it be updated to atleast version 9.7p1.

What are the plans for that if any?

Thank you in advance.

Best Regards,

Erik Molnar

PhoneBoy — Mon, 10 Feb 2025 20:04:21 GMT

Presume it will be updated shortly.
Best to follow up with TAC.

yuvalmamka — Tue, 11 Feb 2025 09:15:00 GMT

Let me check this with R&D and I'll get back here with an official statement soon.

yuvalmamka — Tue, 11 Feb 2025 12:33:37 GMT

As of March, 2024 our CloudGuard WAF image for VMWare includes R81.20 as the running OS.

Looking at sk182459 - Check Point Response to CVE-2024-6387 - OpenSSH Library RCE, you can see that this OS version is not vulnerable to this CVE.

Napoji — Mon, 17 Feb 2025 19:42:48 GMT

Thanks @yuvalmamka and @PhoneBoy as well for the follow-up!