Security Advisory: CSF Firewall Port Rule Race Condition
A race condition in ConfigServer Security & Firewall (CSF) port rule handling is fixed in this security release: under concurrent reloads, a port rule could briefly apply incorrectly, exposing management ports at the wrong moment. Reinstall CSF from ConfigServer and restart the firewall.
प्रभावित संस्करण
CSF 14.20 and earlier
पैच किया गया संस्करण
CSF 14.21
डिफ़ॉल्ट अपडेट कमांड
yum update -yसुधार कमांड
AlmaLinux 9 / CloudLinux 9
cd /etc/csf
csf -u
csf -rAlmaLinux 8 / CloudLinux 8
cd /etc/csf
csf -u
csf -rCentOS 7 / CloudLinux 7
cd /etc/csf
csf -u
csf -rSharedLicense लाइसेंस के तहत इसका अर्थ
Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8, AlmaLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
CSF applies its port rules by regenerating and reloading firewall configuration. The race condition meant two overlapping reloads could interleave, leaving a rule in the wrong state — in the worst case, a management port that should be closed stayed open until the next clean reload.
Who is affected
Servers running CSF where rules change automatically (login failures, cluster updates) — the overlap windows are exactly those automatic flows.
How to apply the fix
- Reinstall CSF from the ConfigServer distribution:
csf.tgz, thencsf -rto reload rules cleanly. - Verify listening ports against
csf.confexpectations after the reload.
For SharedLicense customers
Licensing is unaffected — CSF is free firewall software. This is a low-severity fix; apply it in the regular maintenance window.
अक्सर पूछे जाने वाले प्रश्न
What is the CSF race condition?
How do I apply the fix?
How serious is it?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें