Open CVEs right after update

[mooh]

Just after updating to 26.4_6 the security audit produces a list of 7 vulnerabilities with CVE. Is this the new normal now that AI is searching for them?

This is not meant to discredit the OPNsense maintainers, just a general question. I just want to be prepared for a time when running a firewall with known vulnerabilities is the new normal.

[Nullman]

Welcome to 2026.

[franco]

Most of it is Python. According to https://peps.python.org/pep-0719/ 3.13.14 will be out by Tuesday, 2026-06-09.

In the meantime we'd have to put in a lot of effort to micro manage Python fixes and potentially clashing with similar efforts in FreeBSD ports. It's not a good option for us at the moment with the priorities we have.

So, yes, 2026. Welcome to the future.


Cheers,
Franco

[franco]

PS: OpenVPN 2.6.20 is not vulnerable. The FreeBSD ports database is wrong but since they skipped the version there's no effort there to be more diligent.

[nero355]

Most of it is Python. According to https://peps.python.org/pep-0719/ 3.13.14 will be out by Tuesday, 2026-06-09.

In the meantime we'd have to put in a lot of effort to micro manage Python fixes and potentially clashing with similar efforts in FreeBSD ports. It's not a good option for us at the moment with the priorities we have.

So, yes, 2026. Welcome to the future.

Does that future include kicking out that weird snake at some point ?? :P

[newsense]

Does that future include kicking out that weird snake at some point ?? :P

There's nothing to kick.

So many things depend on python is not even funny. And the goal is to be on a supported version that can be used with everything that depends on it.

FWIW, FreeBSD 14.x branch is still lagging on python311 while OPNsense was able to jump on the python313 train shortly after 26.1 —- which in turn caused issues on the mimugmail repo with things not building properly.

Thankfully it would appear some if not all of the mimugmail issues have been ironed out as I just found today a new Unifi update along with the associated dependencies.

[franco]

Yep, looking at the current open source ecosystem Python isn't going anywhere in many projects. We're also using it in backend scripting.


Cheers,
Franco

[nero355]

Does that future include kicking out that weird snake at some point ?? :P

There's nothing to kick.

So many things depend on python is not even funny. And the goal is to be on a supported version that can be used with everything that depends on it.

Yep, looking at the current open source ecosystem Python isn't going anywhere in many projects.
We're also using it in backend scripting.

I will keep dreaming of a Python-free World then :)

[franco]

As long as there are no snakes on a plane I guess we're fine.


Cheers,
Franco

[groove21]

CMK is still reporting python313 as vulnerable since months in all my opnsense-instances. Is there any action to do? When will this warning disappear?

[Patrick M. Hausen]

Do you mean this one?

Code Select Expand

root@opnsense:~ # pkg audit
python313-3.13.15 is vulnerable:
  Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines
  CVE: CVE-2025-15367
  WWW: https://vuxml.FreeBSD.org/freebsd/6d3488ae-2e0f-11f1-88c7-00a098b42aeb.html

I am pretty sure OPNsense does not use POP3 anywhere. So that does not apply.

[franco]

Word on the street is that this issue was not backported to 3.13.x and others for fear of regressions. 3.15 is the first fixed Python release with the fix. It gives you a bit of scope regarding the severity of the issue for existing installations discarding the fact that it is about POP3 as Patrick noted.


Cheers,
Franco