search

Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.33k stars 700 forks source link

ClamAV site and update database blocked by CDN in Russia #500

Closed Justuser3310 closed 2 years ago

Justuser3310 commented 2 years ago

Hello, just today I was not able to access the site or update the database through the "sudo freshclam" command.

Command "freshclam" output: mint@pc:~$ sudo freshclam Sun Mar 13 16:58:53 2022 -> ClamAV update process started at Sun Mar 13 16:58:53 2022 Sun Mar 13 16:58:53 2022 -> ^Cool-down expired, ok to try again. Sun Mar 13 16:58:53 2022 -> daily database available for update (local version: 26471, remote version: 26480) Current database is 9 versions behind. Downloading database patch # 26472... Time: 0.1s, ETA: 0.0s [========================>] 16B/16B Sun Mar 13 16:58:53 2022 -> ^downloadPatch: Can't download daily-26472.cdiff from https://database.clamav.net/daily-26472.cdiff Sun Mar 13 16:58:53 2022 -> ^Incremental update failed, trying to download daily.cvd Time: 0.1s, ETA: 0.0s [========================>] 16B/16B Sun Mar 13 16:58:53 2022 -> ^Can't download daily.cvd from https://database.clamav.net/daily.cvd Sun Mar 13 16:58:53 2022 -> ^FreshClam received error code 403 from the ClamAV Content Delivery Network (CDN). Sun Mar 13 16:58:53 2022 -> This could mean several things: Sun Mar 13 16:58:53 2022 -> 1. You are running an out-of-date version of ClamAV / FreshClam. Sun Mar 13 16:58:53 2022 -> Ensure you are the most updated version by visiting https://www.clamav.net/downloads Sun Mar 13 16:58:53 2022 -> 2. Your network is explicitly denied by the FreshClam CDN. Sun Mar 13 16:58:53 2022 -> In order to rectify this please check that you are: Sun Mar 13 16:58:53 2022 -> a. Running an up-to-date version of FreshClam Sun Mar 13 16:58:53 2022 -> b. Running FreshClam no more than once an hour Sun Mar 13 16:58:53 2022 -> c. If you have checked (a) and (b), please open a ticket at Sun Mar 13 16:58:53 2022 -> https://github.com/Cisco-Talos/clamav/issues Sun Mar 13 16:58:53 2022 -> and we will investigate why your network is blocked. Sun Mar 13 16:58:53 2022 -> ^You are on cool-down until after: 2022-03-14 16:58:53 Sun Mar 13 16:58:53 2022 -> !Database update process failed: Forbidden; Blocked by CDN Sun Mar 13 16:58:53 2022 -> !Update failed.

Site output: Error 1020 Ray ID: 6eb564255c9f166c • 2022-03-13 14:17:06 UTC Access denied What happened? This website is using a security service to protect itself from online attacks.

But cloudflare in other sites doesn't block me(for example spigotmc.org).Except some sites(1-3 sites,for example systranbox.com).

And... My IP: 88.210.29.10 (Russia) I kind of read the news of this antivirus and so far they have not blocked Russian users. Or did they do it?

It’s just that I don’t have any special assumptions anymore why ONLY from my IP address I can’t visit the site and update. Against the background of numerous blockings, only such an idea appears. If this is so, then ... Not only companies, but also ordinary users were blocked, including me.

I am hope for your help.

band-rk commented 2 years ago

The same issue, Ru zone probably banned.

raven-oscar commented 2 years ago

Same issue. Various networks in Russia.

vlad-rubtsov commented 2 years ago

The same issue, Ru zone.

Justuser3310 commented 2 years ago

Sadly...

micahsnyder commented 2 years ago

I'm sorry to report that ClamAV.net has been blocked for Russian IP's. Cisco, which owns and operates ClamAV and ClamAV.net, has stopped providing goods and services to Russia. You can read Cisco's official statement, here: https://www.cisco.com/c/m/en_us/crisissupport.html

We do understand that this decision not only affects organizations, but individual users as well. Cisco is continuously evaluating the current situation and will make any determinations in the future should the situation change.

Justuser3310 commented 2 years ago

Thank you anyway.

It’s sad, of course, that these measures also hit ordinary users. Unfortunately, political games will always be played, even in the IT sphere...

I don’t know who to believe and who not, who is right, I’m not a politician and not a historian, but in the end I want to say: Trust no one. And question everything.

micahsnyder commented 2 years ago

I am going to pin this issue for a time, trim away excessive comments, and lock the conversation to make the official response (above) more obvious to those who encounter this issue.

Don't open a new issue for this topic.

This isn't the place to talk politics and our response isn't going to change simply so that you can continue to receive free malware signature database updates for our free software. We, the ClamAV team, do not have the authority to disobey government sanctions or disobey Cisco policy in response to those sanctions. We may re-enable access to the impacted regions if there is new direction from Cisco's legal department or if the sanctions are lifted.