4.3 release

[Simon Bartley]

Hi,

 

Do we have a planned release date for 4.3. I am aware of the bug that has been fixed https://github.com/wazuh/wazuh/pull/10168 regarding the vulnerability scanner not working on windows 10 20H1 and later.

 

Most of the PC’s I look after are on 20H1 and later so not having this feature is a bit of a pain.

 

Is there a way I can install 4.3 before its released so I can demo the system further with the latest version of windows 10 ?

 

Thank you.

[Ramiro Decatri]

Hello @sbartley08 !

I understand the requirement, let me discuss it a bit with the team tomorrow and get back at you.

Regards.

[Alexey]

Hello, All.
I have the same question regarding debian 11 bullseye, there was a pull request, but there was no support in 4.24 and 4.25.
https://github.com/wazuh/wazuh/pull/10357/commits/da1ec2cc20f93b244b07d6ab4d8e7d31cc456825

среда, 17 ноября 2021 г. в 01:58:25 UTC+2, ramiro....@wazuh.com:

[Damian Nicastro]

Hi @sbartley08!
Thanks for your patience.
The Wazuh release 4.3.0 is estimated to be ready by the end of december of this year.

However, if you are interested in testing our unreleased packages, you can find them in the staging directory of our public repository:
https://packages-dev.wazuh.com/ 

I hope this helps.

Thanks

[Damian Nicastro]

Hi  @sbartley08! 

As an additional comment,  the search bar only searches the current directory, it does not search recursively.If you want 4.3.0 packages you can find them in the staging directory, where you will see different systems, generally all the available ones from each system will appear in its main directory or differentiated by architecture or system (like wpk), but in the case of apt, you can find them in apt/pool/main/w/

It is highly recommended to test this in non productive enironments since these versions are not final releases and they are not supported.

Thanks

[Simon Bartley]

ok so im not sure im doing this right but I have run the unattented script to install 4.2.5 then :

wget https://packages-dev.wazuh.com/staging/yum/wazuh-manager-4.3.0-0.40302.20211116.x86_64.rpm

rpm -U wazuh-manager-4.3.0-0.40302.20211116.x86_64.rpm

this seem to go through and was able to install 4.3.0 agent on a windows pc but when I change the config to :

<vulnerability-detector>

    <enabled>yes</enabled>

I get a warning in the logs wazuh-modulesd WARNING  The <ignore_time> tag at module 'vulnerability-detector' is deprecated for version newer than 4.3.

I thought I wait and see what it did anyway but still see no vulnerabilities detected (I installed a old version of adobe reader which does detect on a older windows 10 feature update)

[Damian Nicastro]

Hello

I hope you are fine.

The WARNING message is only a warning that you can't use <ignore_time> in  vulnerability-detector.

Regarding the effectiveness of detecting the vulnerabilities you need, remeber that this is only a candidate package. There is no guarantee that this is ready to work until the final version is released.

Thanks