PortaBilling/PortaSwitch includes third-party open-source and commercial software components that provide core infrastructure functions such as the operating system, database engine, web server, etc. A complete list of components and their licenses is available on the Licensing information / Third-Party Partnerships page.
Software updates and security patches
PortaOne maintains the operating system (OS) and third-party software components up to date across the full release lifecycle. Security fixes are incorporated in every build, and OS/database updates are adopted as they become available.
- Each product release includes a full refresh of all base software packages from upstream repositories, ensuring that the latest security fixes are incorporated at release time.
- Security updates are applied throughout each release's lifecycle as long as the release is maintained. Each new build includes the security updates available at the time of its release.
- Oracle Linux minor version updates are adopted for all active releases as they become available.
- Major OS version updates are included in a new maintenance release.
To ensure that the most current security patches are applied, keep your installation up to date on the latest available version.
Understanding vulnerability scan results
Oracle Linux, like Red Hat Enterprise Linux (RHEL), backports security fixes into existing package versions rather than upgrading to the latest upstream release. As a result, a package version number may remain unchanged even after a security fix has been applied. Version-based vulnerability scanners may report a CVE (Common Vulnerabilities and Exposures identifier) as unpatched when it has in fact been resolved.
CVE-2023-38545 is a critical vulnerability (a publicly tracked security issue) in the libcurl library that was originally fixed in curl version 8.4.0.
Instead of upgrading to the newer version, Oracle Linux applied the same fix to an earlier version of the package (libcurl-7.76.1) and released it as an updated package: libcurl-7.76.1-23.el9_2.4 (via a security advisory).
A vulnerability scanner that checks only the version number may still detect version 7.76.1 and assume that the issue has not been fixed. As a result, it reports the CVE as unpatched, even though the fix is already included in the updated package.
This approach is common across all packages maintained by Oracle Linux. When reviewing vulnerability scan results for a PortaSwitch/PortaBilling installation, check the reported CVE against the Oracle Linux errata list (ELSA advisories) to verify whether the fix has already been backported.
