Check the status of CVEs. Learn More.
Keeping your systems up 100% of the time requires live patching. Our solutions will align strongly with your risk, compliance, and operational uptime requirements.
TuxCare is trusted by the most innovative companies across the globe.
Our partner program is designed with flexibility in mind for partners who are at various stages of their business lifecycle. With financial investment and dedicated resources, you will continue to grow with TuxCare.
Would you like to work with a leader in open source and Linux security that values innovation and partnerships?
Partners receive benefits that are designed to reward the commitment that they have made to the sale of our products and services.
Learn about TuxCare's modern approach to reducing cybersecurity risk with Blogs, White Papers, and more.
Continually increasing Cybersecurity, stability, and availability of Linux servers and open source software since 2009.
August 31, 2021
Here at TuxCare, we pride ourselves on being the trusted provider of maintenance services for the Enterprise Linux industry. Our services improve system administration manageability while maximising system uptime and minimising service disruption.
In this latest monthly overview, you will find a round-up of the latest CVEs patched by the TuxCare Team. Also, carry on reading for details of the latest updates to our range of TuxCare services, along with plenty of helpful advice.
1. CVEs Disclosed in August
2. Enterprise Linux Security Video Podcasts
3. Introducing our CVE Dashboard
4. Extended Lifecycle Support
5. TuxCare Blog: Editor’s Pick
The first vulnerability was found very close to home when our very own Nikita Popov, one of TuxCare’s expert team members, identified a previously unknown flaw in the glibc code. This flaw was uncovered during the investigation of another reported vulnerability. Designated CVE-2021-38604, it was found that a segmentation fault could be triggered in a specific code path within the library. The consequence of this event was that the application using the glibc library could crash, resulting in Denial-of-Service. The glibc library is a critical component, provisioning the main system primitives. Identifying and resolving this issue was seen as a significant win for the team. Our Extended Lifecycle Support Services have produced and distributed live patches for this CVE.
Two other vulnerabilities (CVE-2021-3711 and CVE-2021-3712) were also disclosed in August, both affecting OpenSSL. CVE-2021-3711 is a high severity flaw in the SM2 decryption function that could corrupt memory and allow an attacker to cause a buffer overrun to create a scenario where they could force a privilege escalation. CVE-2021-3712 is a low severity flaw that could also allow an attacker to cause a buffer overrun. Our KernelCare Enterprise Live Patching Service produced and distributed live patches for these CVEs within 24 hours.
The TuxCare team’s Enterprise Linux Security podcast is up and running, offering in-depth topical explanations for the latest hot topics and foundational concepts. Co-hosted by Learn Linux TV’s Jay LaCroix and TuxCare’s very own Joao Correia, the first two episodes are now available to view.
You can watch the first episode that discusses the critical topic of Common Vulnerabilities and Exposures here: Enterprise Linux Security – Episode 01: Common Vulnerabilities & Exposures (CVEs).
Also available is the second episode that discusses common attack vectors here: Enterprise Linux Security – Episode 02: Attack Vectors
These video podcasts discussing Linux security issues are essential viewing for anyone involved in managing Linux-based enterprise systems.
Do you ever wonder if a particular CVE affects your systems and if it has been patched or not? We often receive requests from customers looking for information or inquiring about the status of a particular fix. While we send out announcements for the CVEs that affect our supported systems, you’d soon be overwhelmed if we also sent out a notification for the multitude that don’t affect you. So, to improve transparency and make relevant information easier to find, we’ve created a CVE Dashboard. This lists all CVEs covered under our Extended Lifecycle Support service that can be filtered by OS and other criteria. This feature puts you in control and provides all the information you need at your fingertips. See our blog for more details.
Finally, do you use end-of-life systems, or are you a CentOS 8 operator that’s about to face this issue? Have you ever been tempted to recycle the same old legacy systems as the quick and simple solution to maintaining a service?
If the answer to any of these is yes, you’ll understand the challenges of using legacy systems. Legacy systems are a headache for Sysadmins everywhere, from increased security risks to roadblocks to passing compliance audits. However, when the pressure is on, they may be the best short-term solution for a business. This is where TuxCare’s Extended Lifecycle Support can come to the rescue. It keeps legacy secure and compliant for years, buying you time to research, plan, and implement a long-term migration solution. So why don’t you take a look at this video that helps explain how our service works.
Stay updated with the latest news and announcements from TuxCare.com