Hi Jamf Nation,
Today we're releasing a hotfix for Jamf Pro that addresses a recently responsibly disclosed security issue.
We strongly recommended that you upgrade to Jamf Pro 10.32.1 as soon as possible. The following CVE is addressed by this release:
This is a placeholder CVE that will be updated once we can disclose more information. We have scored this at a 7.5 High security severity using CVSSv3.1 and recommend this update to all customers as this impacts all supported versions of Jamf Pro.
Please read the resolved issues section of the release notes for more information. Additional details on the resolved vulnerability will be made available at a future date to allow for Jamf Pro instances to be patched before full disclosure.
Please note this does not affect the cloud upgrade schedule for this upcoming weekend. You can find the cloud upgrade schedule here.
Read the full release notes here.
Samy boat as everyone else here. We are still running 10.26 and there is no word of what versions are effected. We plan on upgrading next month but it would be nice to know how urgent the upgrade is.
We intentionally do not populate the CVE with the information initially as that would disclose the issue which would put people not patched at risk.
Once customers have ample amount of time to upgrade to the patched version we will update the CVE entry with more information. This time period varies depending on customer adoption.
At this point all we can disclose here is its a security issue that we have ranked at a 7.5 High severity and that it impacts all supported versions of Jamf Pro. There are a few more details that will be shared via email from Customer Success but the crux of the info is that it's a high security severity that is only fixable via upgrading Jamf Pro.
@BadinChuck, Jamf Cloud mass upgrades are scheduled in advance so customers know when services may be unavailable. If a cloud customer wishes to upgrade sooner they just need to reach out to Customer Success. Since we have no control over when customers who host their own instances update we provide the installer immediately and just ask that they do it at their earliest convenience to best protect themselves from risks.
I am guessing this has to do with complexity of the issue, or not wishing to alarm the general public, but that is just a guess on my part. We were not told the details of the specific vulnerability either but just simply that upgrade is recommended wherever/whenever possible
@inflicted, No, the hot fix above is to resolve the Jamf product issue PI-010111.
The forcedentry vulnerability is related to Apple OS functionality. More information on their recent updates can be found at Apple: https://support.apple.com/en-ca/HT212807 & https://support.apple.com/en-us/HT212804
It is recommended that people update to versions recommended by vendors to resolve the issues.
As much as I don't like it (I agree with you @Claude7004 that it should be addressed up front), I can at least explain their logic.
When they discover a severe vulnerability, they put out a patch and hide the details hoping they can get the community (i.e. not JamfCloud) upgraded to a point where, when the details are released, the possibility of compromise is reduced or not existent.
Again, it sucks b/c you don't know the details of what this affects, especially if you have to run the update through a change management process.
@Claude7004 There was one vulnerability that was addressed in this 10.32.1 release and three addressed in the 10.32 release to which we posted updates here in Jamf Nation and also sent communication via email. If you did not receive an email communication, please contact customers success at firstname.lastname@example.org.