Eng. Alessandro Mazzanti

Server #ENTRUST 5.47 Pb. #REREGISTRATION AND FIX

Entrust appliance upgrade to 5.47 version fail.

This is due a known issue affecting upgrades to Gateway version 5.47 when RPM dependency version conflicts are present on the appliance. In these situations, the upgrade process may fail because DNF cannot automatically resolve conflicting package versions.

You have to follow the steps mentioned below:

Problem:

Gateway upgrades install the target IDaaS-Gateway meta package, which pins the appliance RPM set to specific package versions. The upgrade script currently executes DNF without the --allowerasing option.

When upgrading an Enterprise Service Gateway to version 5.47, the upgrade can fail if an installed RPM package requires an older dependency version than the target Gateway version.

Sample log entry:

Installed grub2-tools-extra-1:2.06-114.0.1.el9_7 requires grub2-common = 1:2.06-114.0.1.el9_7. The target Gateway meta package requires grub2-common = 1:2.06-114.0.1.el9_7.1.

Cause:

The Gateway upgrade script invokes DNF package installation commands without the --allowerasing option. When existing RPMs require package versions that differ from those required by the target Gateway release, DNF cannot automatically remove or replace conflicting packages and therefore aborts the transaction.

Solution:

The approach to solving the upgrade failure consists of the following three steps.

Step 1: Re-register the Gateway

Login to IDaaS Admin Portal
Navigate to GATEWAYS
Select the Eclipsis (Three vertical dots)
Select Re-Activate, and RE-ACTIVATE again
Copy the generated Registration Code
Login to the ESG Cockpit
Click Re-Activate.
Select Register, leaving options 1,2 and 3 as-is
Paste the copied Registration Code in the respective field.
Click Register.
Wait for the registration to complete.

Step 2: Modify the Upgrade Script

Select Terminal
Navigate to tools directory:

cd /home/entrust/tools

Verify and note the current permissions and ownership of the upgrade script:

ls -la upgrade.sh

Edit the gateway upgrade script:

vi /home/entrust/tools/upgrade.sh

Locate the following line:

if ! dnf install -y "${META_PACKAGE}"; then

Replace it with:

if ! dnf install -y --allowerasing "${META_PACKAGE}"; then

Locate the following line:

if ! dnf install -y "${META_PACKAGE}-${TARGET_GATEWAY_VERSION}"; then

Replace it with:

if ! dnf install -y --allowerasing "${META_PACKAGE}-${TARGET_GATEWAY_VERSION}"; then

Save the file.
Verify that the modifications were saved successfully.
Reconfirm that the permissions and ownership of upgrade.sh remain unchanged from the values recorded earlier:
Optional. If different, reset to default;

sudo chmod 755 upgrade.sh

sudo chown entrust:entrust upgrade.sh

Step 3: Run the Gateway Upgrade Again

Access the IDaaS Admin Portal
Navigate to GATEWAYS
Select the Upgrade icon on the intended gateway
Select UPGRADE

In case you want to view upgrades logs here it is command:

tail -100 /var/log/gateway_upgrade.log

PALO ALTO #EOL PAN-OS-PANORAMA, HW, VM, GLOBAL PROTECT #PALO ALTO CSIRT #COMPATIBILITY MATRIX

Preferred Release Guidance from Support Perspective

-PAN-OS Release Adoption and Preferred Releases for Firewalls and Panorama
-Preferred GlobalProtect Releases
-Preferred User-ID/Terminal Server Agents

https://live.paloaltonetworks.com/t5/customer-resources/pan-os-globalprotect-amp-user-id-preferred-release-guidance-from/ta-p/258304

End-of-Life - pan-os-panorama

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#pan-os-panorama

End-of-Life - Hardware

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates

End-of-Life - VM

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#vm-series-models

End-of-Life - globalprotect

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#globalprotect

Compatibility Matrix

https://docs.paloaltonetworks.com/compatibility-matrix

🚨 Palo Alto PSIRT

The Palo Alto Networks website allows you to check which CVEs have been published for a specific software release and how many vulnerabilities affect that release.

For example, for version 11.0.13, the CVEs can be sorted by severity as follows:

https://security.paloaltonetworks.com/?version=PAN-OS+11.1.13&sort=-cvss

FIREWALL #How a Super User Creates a New Customer Support Portal User Account

A Super User on an account can create a new CSP (Customer Support Portal) user and add this user as a member to the account.

here it relative very "easy" article

How a Super User Creates a New Customer Support Portal User Acc... - Knowledge Base - Palo Alto Networks

FIREWALL #VM-Series on ESXi Server

It is important to do not create snapshots regarding Palo Alto VM-Series firewall on virtualized environment, here it is relative article and section

"The VM-Series firewall functionality is very similar to the Palo Alto Networks hardware firewalls, but with the following limitations:

Do not use the VMware snapshots functionality on the VM-Series on ESXi. Snapshots can impact performance and result in intermittent and inconsistent packet loss.See the VMware best practice recommendation for using snapshots.
If you need configuration backups, use Panorama, or from the firewall, use Export named configuration snapshot (Device > Set up > Operations). Using Export named configuration snapshot exports the firewall’s active configuration (running-config.xml) and allows you to save it to any network location."

https://docs.paloaltonetworks.com/vm-series/deployment/private-cloud/set-up-a-vm-series-firewall-on-an-esxi-server

HACKER #Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Unfortunately this news is a "normal" consequence on how internet (and IT) "work".
It meansto have all devices interconnected between them (not only referring to LANs but meanly when they rely to internet, exposing delicated services or referring to the cloud).

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers.

Danfoss told AFP that most of the units hit were older products that no longer get software or security updates (the AK-SM 800 and the AK-SC 355).

Danfoss declared the AK-SM 800 end-of-life in May 2021 and phased out the AK-SC 355 in 2016. In an October 2025 newsletter, it said it would end all services for such older products and urged customers to plan replacements.

For the moment the "fix" is to disconnect these devices from lan/Internet. (or other less invasive workarounds, in any case full articles have more technical details there indicated)

These are impacted retailers.

Original article