Upgrading libcurl (miniconda packages) - CVE-2023-38545

Hi,

Can someone point me to the documentation for how to update the embedded version of Python that is installed with Alteryx.

We have a security vulnerability alert for libcurl and I need to be able to update it to version 8.4

We are running Alteryx server version 2024.2

Our scanning software is detecting the vulnerable version of libcurl in the following locations:

CVE-2023-38545

C:\Program Files\Alteryx\bin\Miniconda3\Library\bin\libcurl.dll
C:\Program Files\Alteryx\bin\Miniconda3\pkgs\libcurl-8.1.1-h86230a5_0\Library\bin\libcurl.dll
- Installed version : 8.1.1.0
- Fixed version : 8.4.0

Updates

Accepted answers

All comments

tcheng

Thanks for posting Paul. I am in the same boat and I would require guidance as well. Have you already opened a support case with Alteryx?

Paul_Holden

I haven't, thought I would try a post here first. I'll need to open one by the end of the week if no-one here can help.

Frankly a bit surprised it hasn't come up given how loudly our security scanner is shouting about it.

tcheng

I opened one soon after seeing your post. Last time, I also found out about the MongoDB security issue thru this community forum first. Thanks to you and everyone who actively post here!

tcheng

@Paul_Holden you mind telling me your exact Alteryx version including patch number? Like 2024.2.1.252 (Patch 10)? The fix with version 8.4 was released back in 2023.

Paul_Holden

@tcheng we are on 2024.2.1.162 Patch: 7

>>The fix with version 8.4 was released back in 2023.

The fix to libcurl? Yes.

But that version of Alteryx cannot have been fixed in 2023 as it was not released until 2024. So I'm assuming it was released with the vulnerable version of libcurl.

I'm going to check the patch history as I'm not clear why it hasn't already been fixed.

Paul_Holden

I can't see anything in the patch history, but then it doesn't appear to include the python environment. I've looked at the separate page for that and I can see nothing about security fixes or how to update specific libraries.

Alteryx Embedded Python

I have opened a support case.

tcheng

My support rep advised the below:

"It looks like this was specifically addressed in Patch 4 for 2024.1. Our product team looks to be recommending the latest patch of either 2024.1 or 2024.2, regardless."

Paul_Holden

Interesting as I have been told to upgrade to 2025.2, which is something I cannot do at this time because of the number of changes between 2024 and 2025.

I can patch but I'm not being told that this has been fixed in a patch.

This is a critical security vulnerability now, and one that I feel is reasonably easy to fix, so I would expect a patch to be available.

Since as far as I can determine this is part of the custom tools SDK, and therefore not even used by the core application, I'm considering testing a simple removal of the file from the packages folder.

tcheng

Got it. As for me, I'm on 2024.1 so I will be upgrading my environment to 2024.2 in the coming weeks to stay supported until at least the end of Oct 2026. We also can't upgrade to Alteryx 2025 mainly due to license change (i.e Alteryx One) and more importantly AI component involved. That must be sorted out before September 2026.

T_Willins

We applied for an internal exception as downgrading is not an option and we are going to 2025.2 in the spring. In addition, we have an open case with Alteryx requesting a patch for 2024.2 as this version is in support and a identified vulnerability.

tcheng

So I upgraded my Alteryx Server from 2024.1 to 2024.2 with patch 10 (latest available). I then checked the 2 files and they are still on version 8.1.1.0 instead of 8.4.0.

Given that support for version 2024.1 will end on 5/1/26, we must stay on version 2024.2 until we upgrade to version 2025 and above in Aug/Sept of this year. I've updated my support case and see if they might have any patch in development that addresses CVE-2023-38545.

tcheng

Sharing an update from my support ticket:

Our Product team suggested that a user would need to upgrade to 2025.2 since the Python Tool / SDK v1 was removed in that version.

Please let me know if that would be a possibility for your team here. I see that there were some additional requests about potentially trying to apply this to previous versions but am unsure of its progress as of now.

Paul_Holden

@tcheng we have been pushing hard for a patch to 2024.2

In our opinion it is unacceptable that this hasn't been patched when 2024.1 has been.

We also asked if there was any advice on when this file is used and whether we can simply remove it (as we have done where it is included in out of date ODBC driver installations, mostly on Microsoft products) or just upgrade it, as we have done for other products, having confirmed that the 8.4.0 version is generally compatible. We haven't received anything back on that.

Note that at this point we are only concerned about the server installation.

This was my latest response from the support team as of 5th March.

I wanted to let you know that we’re currently reviewing this internally with our cross-functional teams. It’s taking a bit more time as we work through the details.
We understand the urgency on your side & will get back to you as soon as possible with a clear update.
Thank you for your patience.

Paul_Holden

I have been informed by Alteryx support that they do not intend address this critical security vulnerability in supported version 2024.2

We have been informed that we must upgrade to 2025.1 even though I have made it clear that we cannot do that in a timescale that meets our security teams SLA for a vulnerability at this level, in part due to the extensive changes between the 24.x platform and the 25.x version.

This library is extensively used across the industry. We have had several hundred instances, across multiple applications, that needed to be fixed across our server estate. Alteryx is the only application where we do not have an acceptable resolution for this issue.

My understanding is that 24.1 and 24.2 use exactly the same framework for the python extensions. I am therefore at a loss to understand why is there no patch for 24.2? I have put that exact question to the support team but received no response. Also why Alteryx decided to patch a version that was EoL in the very near future but not the incrementally upgraded system that would take us through the the 25.x platform. As far as I can tell both systems were in support when the 24.1 patch was released?

Quick Links

This months top contributors

atcodedog05 19598

Qiu 15867

binu_acs 15708

MarqueeCrew 13708

apathetichell 13703