Checking Server Security Updates

SetFN updates contain security fixes for the SetFN server program and the libraries included in it. The operating system that SetFN runs on, and the external programs SetFN calls for document previews, conversion, and character recognition (OCR), must be updated by the server operator.

Based on the KISA (KrCERT/CC) security notices and the review of major vulnerabilities (CVEs), this document explains what operators should check and the commands to use. The examples are for Ubuntu 24.04 LTS.

Before you begin

• Sign in to the server with an account that has sudo privileges.
• A kernel update takes effect only after the server is restarted. Do this when few users are active.

Update operating system packages

1. In a terminal, refresh the package list and install security updates.

   sudo apt update
   sudo apt upgrade
   

2. Check whether a restart is required. If the file exists, a restart is required.

   ls /var/run/reboot-required
   

3. After restarting, confirm that SetFN is running normally.

The following components are ones for which KISA has recommended security updates since 2025. The commands above update them as well.

Check document processing programs

SetFN uses the following programs for previews, conversion, and character recognition of files that users upload. These programs read files received from outside directly, so do not postpone their security updates.

Receive security fixes for universe packages with Ubuntu Pro

On Ubuntu 24.04, LibreOffice, Poppler, and libheif are packages in the main repository, so sudo apt upgrade installs their security fixes. libvips, Tesseract, MuPDF, Pandoc, ImageMagick, and FFmpeg are packages in the universe repository. Fixes for the High-severity or higher vulnerabilities published in these packages since 2025 have been provided only through esm-apps in Ubuntu Pro.

If you use these programs, attach the server to Ubuntu Pro.

1. Get a token from Ubuntu Pro.
2. Run the following commands on the server.

   sudo pro attach <token>
   sudo pro enable esm-apps
   sudo apt update
   sudo apt upgrade
   

3. Check that pro status shows esm-apps as enabled.

Reduce document processing programs you do not need

• MuPDF (mupdf-tools): When Poppler (poppler-utils) is installed, SetFN does not use MuPDF. MuPDF has a vulnerability (CVE-2026-3308) that is not yet fixed on Ubuntu 24.04, so we recommend not installing it. If it is already installed, you can remove it with sudo apt remove mupdf-tools.
• ImageMagick, FFmpeg: If they are not installed, SetFN simply does not use the corresponding conversion and video thumbnail features. If you do not use them, do not install them.
• FFmpeg 8.x: If you built it yourself or installed it from a separate repository, update to 8.0.3 or 8.1.2 or later (CVE-2026-8461).

Java use in LibreOffice

A vulnerability in LibreOffice (CVE-2026-63277) lets an external data connection inside a document load a remote Java driver, and the fix is not yet included in the Ubuntu 24.04 package (checked 2026-10-23). SetFN creates a fresh LibreOffice profile every time it converts a document and disables macros and external link updates in that profile. Starting with the update that includes the fix from the 2026-10-23 review, Java is disabled in the same profile as well. If Java is not needed for anything else, removing the Java runtime from the server reduces the risk further.

Check when running with Docker

If you run SetFN with Docker, confirm that the following components are at these versions or later.

Check when using a reverse proxy

If you place a reverse proxy such as nginx in front of SetFN to handle HTTPS, the reverse proxy also needs security updates.

• For open source nginx, 1.30.4 or 1.31.3 or later is recommended. Distribution packages receive the fixes through the distribution's security updates.
• An attack that makes web servers with HTTP/2 enabled use excessive memory (CVE-2026-49975) has been announced. Apply the fixed version of the web server you use.
• If you serve HTTPS with a publicly trusted certificate, enable the HSTS header (Strict-Transport-Security) on the reverse proxy. The SetFN server does not send HSTS itself, so that access is not blocked in internal network installations that use self-signed certificates.

Check when using local AI (Ollama)

If you run local AI models with Ollama on the same server as SetFN, check the following.

1. Check the version with ollama --version and update to 0.17.1 or later (CVE-2026-7482).
2. Make sure the Ollama API is not exposed externally. If it is used only on the same server as SetFN, do not set OLLAMA_HOST to 0.0.0.0.
3. If another server must connect to Ollama, allow only the SetFN server's address in the firewall.

Back up the administrator two-factor authentication key

Servers that use administrator two-factor authentication store the encryption key that protects the authentication data in secrets/admin-mfa/ under the configuration folder. Copy this folder along with the server when you back it up or move it. If the restored server does not have this key, two-factor verification fails for every administrator, and you must reset each administrator's two-factor authentication with the user mfa reset command and set it up again. See Set up administrator two-factor authentication for details.

Check when using an external AI integration

If an external AI integration (AP bridge) calls SetFN's /api/ai-proxy, set the same SETFN_AI_PROXY_TOKEN value as an environment variable on both the SetFN server and the integration program. Starting with versions after the 2026-10-23 security review, requests sent from the same server can no longer use this path without the token.

Good to Know

• Security issues that directly affect SetFN are fixed through SetFN updates. Keep SetFN on the latest version as well.
• Whether each notice applies to SetFN and its review status can be checked in Vulnerability Status.
• Restricting access to the admin page to specific IPs further reduces the risk of external attacks. See IP Access Restriction.

Related Documents

• How SetFN Reviews Security and Ships Updates
• Vulnerability Status
• Installing on Linux