FreeNAS 12.0-U8 Vulnerabilities on httpd and openSSL

[llaeti]

Hello,

I noticed that TrueNAS 12.0-U8 may be vulnerable to CVE-2021-41524, CVE-2021-41773 (Apache httpd vulnerabilities) and CVE-2021-41617 (Openssh) and wanted to check the correct steps to mitigate them.

The Apache httpd vulnerabilities have a CVSS v3 score of 7.5 (high) and appear to be exploitable with Metasploit.
The OpenSSH vulnerability is rated with a CVSS v3 score of 7.0.

1) Is TrueNAS really vulnerable?
2) Is there a patch available or planned in the next release?
3) How to mitigate it?

Thank you for your answer.

 

[anodos]

httpd is only used for webdav service. According to FreeBSD's vulnxml database the CVEs about it were fixed in apache version 2.4.50. We are on 2.4.51_2.

We don't expose the options affected by CVE-2021-41617.