1

Good day all.

I recently inherited ownership of a Fortinet EMS server, as well as all the vulnerabilities and at-risk endpoints that come along with it.

I have been working to patch or remove software as much as possible, however I am noticing some issues with Python and log4net.dll in particular.

Python:
Certain users’ machines show flags for python CVE. I have had these users update or uninstall python if they are not using it. On my machine, uninstalling and downloading a new version cleared the alert. However this is not the case for some. After completing this task, some users still show scans indicating critical python CVEs, even though in some instances python is not on their machine.

I understand there can be remnants, so what would the best way to ensure all aspects of python are either removed, or properly patched?

log4net:
Apache log4net has been a pain for me, because the log4net.dll is used by quite a few programs. I used mRemoteNG for rdp sessions, and upon updating log4net.dll, it broke my program.

I have a script that locates instances of this .dll and updates them to the newer version. The script and replacement work, but I do not wish to break other peoples programs. Has anyone ever had to patch this particular file?

Conclusion: I am a bit new when it comes to more granular patch management (usually just server and workstation OS patches), so I am looking for best practices, and any advice about performing thorough searches and patching.

Thank you.

6 Spice ups
2

That is a very old finding, it could be old dlls, try searching for the ones noted and remove them, it could also be old registry keys or leftover pieces of the product, where the version number is the reason for the flag.

Other reasons may be:

Remnants of old Python installs (e.g., in AppData, ProgramData, or custom install paths)
Multiple versions installed side-by-side

Start by location the files

Get-ChildItem -Path C:\ -Recurse -Include python.exe -ErrorAction SilentlyContinue

and checking the registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Python
HKEY_CURRENT_USER\SOFTWARE\Python
4 Spice ups
3

Hi Jay,

Use Microsoft fixit to uninstall the remaining agents completely. please find below link.

3 Spice ups
4

(post deleted by author)

5

Completed this but the vulnerability is still being flagged.

1 Spice up