CVE-2021-41163 false positive

Product Support

AI-generated summary

rbos reports that their Discourse instance is falsely flagged by a security scanner for CVE-2021-41163, which relates to the /webhooks/aws endpoint. Despite being on version 2026.01.0-latest (well past the patched 2.7.8), the scanner incorrectly assumes they’re running an outdated version—likely due to misparsing the new versioning scheme. rbos seeks a way to disable the AWS webhook endpoint to appease their IT team, or a method to verify the patch is applied. RGJ suggests explaining the versioning change to the scanner’s team, comparing it to Microsoft skipping Windows 9, and notes the issue emerged between 3.6.0beta and 2026.01. rbos confirms they’ve tried explaining this multiple times, but the scanner’s verdict is treated as final. RGJ implies the CISO may be unreasonable and recommends filing a bug report with the scanner vendor.

1

Hi,

I’m getting messages from our central IT complaining that our Discourse instance is triggering a security warning on CVE-2021-41163, which regards the /webhooks/aws endpoint.

I’ve told them that we’ve kept the software up to date since 2021 (we do a “launcher app rebuild” every month automatically) but their scanner is still flagging it as a problem. It’s convinced we’re running a version before 2.7.8 (2021), but we’re on 2026.01.0-latest. So I’m pretty sure their scanner is just mis-parsing the version string, or detecting the existence of the endpoint and complaining about that.

I’m 99% sure it’s not a problem, but I need to convince them of that.

Is there a clean way of disabling the AWS webhooks endpoint without having to tweak discourse.conf? That would probably mollify them.

Of course there’s always that 1% possibility that we’re NOT patched, in which case, I’d be happy to have some way of testing that. I did some grepping through git log but I don’t see a specific reference to that CVE.

Advice?

2

It shouldn’t be too hard to explain to them that there is a new versioning scheme and their scanner doesn’t understand? Which is the same reason why Microsoft skipped Windows 9.

Esp since you can prove that this started between 3.6.0beta and 2026.01…

3

You would really think so. I’ve done that three times, but scanner says bad therefore bad.

4

Sounds like a bad CISO then… :roll_eyes:

File a bug report at the scanner corp?