Any progress in patching this Vulnerability? https://github.com/botlabsDev/CVE-2020-11881

If you are watching the release dates so close you’d notice that atleast the last 3 (maybe more) long term builds were released to public after ~7 days of probably inside testing since they were built. Read first, blame later. Cheers.

Changelog always has referenced last build date, not release date.

I do not check them “so closely” and I think in 99% of time few days does not matter. I accept your point that this may be part of the thorough testing process for Longterm branch. (I edited my original post now to reflect this) But if BootlabsDev claims: The bug was reported on 06.04.2020 and wa…

Communication could use improvements on the side of Mikrotik. It is not lying but just not telling. the fixed version was ready last week but that was not communicated with the CVE publishers. in this thread Mikrotik should have written, “it was fixed last week and fix was released today”. It is…

So what has be stumped here is what is vulnerable and what is not. The Github repro says this: Affected Versions(tested) 6.41.3 (long term release) 6.45.8 (long term release) 6.45.9 (long term release) 6.46.4 (stable release) 6.47.2 (stable) 6.47.3 (stable) 7.0beta5 (beta) 7.1beta2 and bel…

Currently only the long-term version channel (v6.46.7) has all the necessary fixes for this CVE. We are working on getting them published in stable and testing channels as well. Sorry for any inconvenience.

Currently only the long-term version channel (v6.46.7) has all the necessary fixes for this CVE. We are working on getting them published in stable and testing channels as well. Sorry for any inconvenience. Thanks for the clarification.

Currently only the long-term version channel (v6.46.7) has all the necessary fixes for this CVE. We are working on getting them published in stable and testing channels as well. Sorry for any inconvenience. Thanks.. Let’s wait for that.

Does anyone at Mikrotik have any update on when this CVE is going to be fixed. According to OpenVAS scans, even 7.3.x is still vulnerable and I haven’t found anything in the release notes to suggest its fixed.

Please provide some links with proper info when you wake up 2 years old topic.

CVE-2020-11881 PATCH

RouterOS General

Znevna June 16, 2022, 2:38am 24

I bet it’s not even enabled.