topic Re: Python version in SMA AsyncOS v14 build 418? in Web Security

Python version in SMA AsyncOS v14 build 418?

Brandon Eldridge — Wed, 21 Jul 2021 14:05:32 GMT

I'm seeking to address a vulnerability on an SMA appliance which is currently running AsyncOS 13.6.2. I want to upgrade to version 14.0.0 build 418 to see if my vulnerability is resolved.

Does anyone know if the newer version of AsyncOS includes Python 3.x? If not, is anyone aware of Cisco planning to address this to resolve vulnerabilities in older versions of Python on AsyncOS?

Thank you in advance for any help anyone can provide!

Re: Python version in SMA AsyncOS v14 build 418?

Ken Stieers — Wed, 21 Jul 2021 14:48:54 GMT

Here's blog post detailing Cisco's position.
https://community.cisco.com/t5/security-blogs/python-on-secure-email-vulnerability-concerns-july-2021/ba-p/4433037
Basically, if they aren't using the functionality/you're not exposed, they leave it. Otherwise they're fixing the Python as its open source.
New version of Python coming in Async OS 15.

Re: Python version in SMA AsyncOS v14 build 418?

Brandon Eldridge — Wed, 21 Jul 2021 15:25:43 GMT

Fantastic, thank you Ken!