Its bad practice to disclose details that attackers can use without giving users a decent amount of time to update. Details will be disclosed at a later point in time.
that'd be really odd since 1.43.3 has been out for months and for something significant enough to send an update today not to be related to a more recent or specific release. like super odd
It's probably a third party code library that was updated in that version which had a vulnerability. This may or may not have been because of security concerns. 1.43.3 is just the minimum version without the vulnerability.
Generally speaking zero days are reported to the owners of the product, they have some disclosure period to release a patch (which Plex has done), or if a patch is not possible within the disclosure period they can release a mitigation (a config change, or turn off a feature, or add a firewall rule etc which prevents the exploit). At the end of the disclosure period (after ample time to get the patches out) the zero day is published (generally an explanation and proof of concept to recreate) in which time it is no longer valuable to anyone looking to leverage it to attack servers.
Standard practice, and becoming even more so. Patch notes are going to probably be pushed months past when you need to update in order to slow down attackers.
Not really. Giving a lot of details would be literally saying « here’s how to hack not up to date Plex server ». It to let time to users to update their servers before a complete communication
I actually found the problem like an hour after asking you. Going into my plex folder, one of my certifications was bad. I deleted it, launched plex and it redownloaded the certificate. My port started working instantly.
If you do accidentally hit the skip button (as I did), is there a way to override that and force the update. Though I am on 1.43.3, so it seems like I'm good, but other than manually downloading the file, there's no way to get Plex to force an update once you hit skip?
You should be more concerned about any software you use that DOESN'T patch "a number of security issues" because that means they are either ignoring them or ignorant of them.
I've been having issues with remote access for a while. Figured I would have to delve into port forwarding. Does this new version break it even further?
I think the announcement is actually the late one. My docker container which is 1.43.3 was released on Aug 4th so if you updated in the past month or so you should already have the security patches.
With the release of Anthropic Mythos, which has been fed all open source code and a large swatch of proprietary code from many vendors, new exploits are being found and patched at a highly increased rate.
It's going to be a long and bumpy ride, but in the end more secure code is the end goal.
The last two releases have stopped responding to client requests entirely for me. No thanks
Edit: my working version is 1.43.2.10687
I have tried the two releases after this one and neither worked so I downgraded back to 1.43.2.10687 both times with great success. The app and logs didn't show me any indication that anything was wrong, but it didn't respond to any requests. Restarting the service worked but only for a minute or two
I don't use docker for Plex. Just a straight install
These last 2 releases it just stops responding. It is running, but my media shows as unavailable. I have to restart plexmediaserver and it is available again for a couple of mins. Over and over. I've kept it downgraded to a version from like Aug 2 and have had not had this issue since that downgrade
Not behind cgnat. This is my only plex server. The same host runs other applications, but downgrading the plex software fixing my issue, to me, means it is the software causing the issue
are you willing to reproduce then DM me your logs? you can send them via the plex forums if that makes you more comfortable. We have seen a handful of users reporting this issue but have not (to my knowledge) found anyone willing to work with us to track it down.
If you are running Kometa or anything that uses the same token as Plex, it will advertise as Sync on Plex side. You need to generate a separate token for Kometa and the likes. This was not a problem before but the latest updates have this restriction now.
I run plex locally on a Linux server and have had the same issue. TVs and Roku won’t see the server downstairs even though they are on the same network. 1.43.2.10687 is the only version that continues to work.
Guess I’ll just close up my whole, not like I was sharing with anybody anyway.
While Plex maybe have been the tool to breach LastPass, the fact that LastPass allowed unrestricted devices to access their production environment is beyond stupid. That’s some start-up mentality, where being extremely fast and agile are more important than anything else.
I actually didn't know that Plex server updates are now available through package manager on a NAS - I was still updating the old fashioned way downloading the update to my desktop and then installing it from there.
So I’m new to having a plex server and am currently using a UGREEN nas to host mine. How would I apply this update since it says it needs to be installed manually
Yeah I'm also on that version. I run the Docker image lscr.io/linuxserver/plex:latest and it looks like 1.43.3.10896 came out about 2 weeks ago in that image.
Tl;dr: this email is going out to people who still haven’t updated their servers. If you updated to 1.43.3 in the last couple of weeks you won’t get it. There is no new update.
Ah, thanks.. I was a little worried, so I checked my server version and it matched. Then I noticed on their site the update was posted Aug 12th, and I had updated a week ago according to my Bash history.
How is this update going to hose those who haven't updated their server in a long while (those who didn't update so they could avoid all of the bad updates)?
PDQ is "pretty darn quick[ly]" -- install it as soon as possible!
A CVE is the standardized description & serial number for a given security vulnerability. (It actually stands for "Common Vulnerabilities and Exposures.")
Well I also didn’t get the email but I think that might be because I have my email spam filters set to the same sensitivity of my dog looking for squirrels in the yard.
I can't help but feeling the same way. They pour their ENTIRE effort into trying to siphon my attention away from my own media and toward their live services, removing features that I regularly used -- I actively have reasons to not update.
Better yet, they routinely sneak feature flags into the server long before they go active. So to avoid unwanted changes, you have to be many versions behind.
Just wondering about the HDTV app in Windows 11. I've only been using it a few weeks and got it through the app store. Before I'd just download the regular app from the Plex site.
Unless I'm missing something, Microsoft appstore doesn't give an update option in the store, and all I could do was open the already installed app. But it doesn't have an update setting like the old app; at least not that I can see. I've updated my remote server without a problem and I did start some updates in Windows, but I think that's just .NET updates.
Any help from anyone familiar with this HDTV app would be great.
There's a few posts on their forum about this. They claim is plex responsability to bring the update to them... On plex website, last version is avalaible for tos 5&6, i'm on 7... Well, i think it's going to take long time, as you said they don't update frequently
How screwed am I if I can't update this for another 4 weeks? Working very remotely, and apparently the Docker script I did isn't forcing the Plex container to update.
Just checked. I'm already on 1.43.3.. Does it matter that there is another update (1.43.3.10896) but I'm on 10861? I'll update it eventually, I just like to wait for a while to see if there are no server breaking issues with it.
It caused me a lot of tediousness the last time when an update caused the database to balloon up to 40-50 GBs
The official plex docker is a bit different than most docker containers. They very very rarely update the image but the image has a built in function that it updates your actual image automatically at startup. So a quick restart will get you the latest and greatest without any additional container update.
Plex updates have a history of making things worse so I'd really prefer they tell me WHY before I risk breaking shit on a perfectly working version. Does this exploit require remote access? Give us SOMETHING. Updates are too risky in the current era
I just did the update to the latest PMS (Windows) per the email that was sent out and I had remote access issues with it showing remote access available but with an unknown IP address. Remote client (my phone) could not see the server, but Plex dashboard app could connect fine. I fixed it by signing out of PMS on the Windows PC, rebooting the server, signing back in, then disabling and re-enabling remote access. I also had to log out and back in again on my phone to get a new token. Hopefully this helps anyone who has the same issue.
Do i have to? I'd gladly tithe 10% of my cpu power and bandwidth to a Chinese botnet if I don't have to mess with updates again. 10% botnet passport when?
Sorry, cannot update PMS without know what it is patching. Patching something without a brief description of the issue or solution, and no way to revert back or undo the changes is a big cybersecurity no no 101.
You say that very confidentially when we dont know the status of their repository, code scans, pr process, vulnerability scanning, etc etc. Open source is arguably under more scrutiny and active contributors can work towards a better project. Thats why it's no surprise some of the most wildly adopted applications and software trusted by enterprises far bigger than plex not only rely on open source, but also open source their own projects.
232
u/ExtensionMarch6812 Sep 01 '26
The full post: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/1