topic CVE-2025-32728 - permanent solution? in General Topics

CVE-2025-32728 - permanent solution?

S_E_ — Wed, 08 Oct 2025 11:21:52 GMT

Hi,

just stumbled over this statement in https://support.checkpoint.com/results/sk/sk183394 :

Installation of any Jumbo Hotfix Accumulator Take or upgrade to a higher version will restore the default Gaia OS configuration (will implicitly enable the parameter "AllowAgentForwarding" again).

Therefore, you must perform this procedure again.

Since this a requires a lot of effort if you have a huge CP install base.

Will this somehow make it into a clish config parameter and survives upgrades?

Thanks

Regards

Re: CVE-2025-32728 - permanent solution?

the_rock — Wed, 08 Oct 2025 11:55:11 GMT

Excellent point there @S_E_

I just checked my cluster and single gw lab and all of them show below. Cluster is R81.20 and cp-gw is R82 (all latest jumbo)

Andy

[Expert@CP-GW:0]# sshd -T -C addr=localhost | grep -i "AllowAgentForwarding"
allowagentforwarding yes
[Expert@CP-GW:0]#

Re: CVE-2025-32728 - permanent solution?

PhoneBoy — Wed, 08 Oct 2025 13:20:02 GMT

While providing clish for said parameter is an RFE, I’m curious why we don’t fix the default sshd_config here, which seems simple enough.
Let me ask.

Re: CVE-2025-32728 - permanent solution?

PhoneBoy — Wed, 08 Oct 2025 16:44:11 GMT

Looks like we plan to release a fix integrated into the jumbo for this: PMTR-117744
It isn’t in the jumbo hotfix yet.

Re: CVE-2025-32728 - permanent solution?

Bob_Zimmerman — Wed, 08 Oct 2025 17:14:43 GMT

Yep. My company's vulnerability management team has been flagging this issue and wasting a lot of time having us "fix" it one cluster at a time only for it to be undone in our next round of jumbos. We pushed for CFG to put it in a jumbo directly.

I still can't believe how much time we wasted on CVE-2023-48795 ("Terrapin"), which isn't even a vulnerability in the first place.

Re: CVE-2025-32728 - permanent solution?

the_rock — Wed, 08 Oct 2025 17:20:29 GMT

Good news!

Re: CVE-2025-32728 - permanent solution?

S_E_ — Thu, 09 Oct 2025 05:40:52 GMT

Sounds good. Thanks.