CVE-2025-32728 - permanent solution?

[S_E_]

Hi,

just stumbled over this statement in https://support.checkpoint.com/results/sk/sk183394  :

Installation of any Jumbo Hotfix Accumulator Take or upgrade to a higher version will restore the default Gaia OS configuration (will implicitly enable the parameter "AllowAgentForwarding" again).

Therefore, you must perform this procedure again.

Since this a requires a lot of effort if you have a huge CP install base.

Will this somehow make it into a clish config parameter and survives upgrades?

Thanks

Regards

[the_rock]

Excellent point there @S_E_ 

I just checked my cluster and single gw lab and all of them show below. Cluster is R81.20 and cp-gw is R82 (all latest jumbo)

Andy

[Expert@CP-GW:0]# sshd -T -C addr=localhost | grep -i "AllowAgentForwarding"
allowagentforwarding yes
[Expert@CP-GW:0]#

[PhoneBoy]

While providing clish for said parameter is an RFE, I’m curious why we don’t fix the default sshd_config here, which seems simple enough.
Let me ask. 

[PhoneBoy · Accepted solution]

Looks like we plan to release a fix integrated into the jumbo for this: PMTR-117744
It isn’t in the jumbo hotfix yet.

[Bob_Zimmerman]

Yep. My company's vulnerability management team has been flagging this issue and wasting a lot of time having us "fix" it one cluster at a time only for it to be undone in our next round of jumbos. We pushed for CFG to put it in a jumbo directly.

I still can't believe how much time we wasted on CVE-2023-48795 ("Terrapin"), which isn't even a vulnerability in the first place.

[the_rock]

Good news!

[S_E_]

Sounds good. Thanks.