═══════════════════════════════════════════════════════════════════════════
  PCI DSS PREGUNTA 34 — PAQUETE DE EVIDENCIA
  Versiones firmware/OS/parches: cde-pool-node-01 + fintrix-pci-db
═══════════════════════════════════════════════════════════════════════════

PCI DSS Q34 (PCI v4 Req 6.3.3 + 6.4) requiere:
  - Actualizaciones de seguridad/parches actuales
  - Proceso de despliegue de parches
  - Plazos (SLA por severidad)
  - Niveles de patch level

QSA solicitó: Versiones de firmware, OS y parches para:
  - cde-pool-node-01 (= cde-38q702, K8s worker node del CDE pool)
  - fintrix-pci-db (= fintrix-production-fintrix-pci, PostgreSQL managed)

═══════════════════════════════════════════════════════════════════════════
cde-pool-node-01 (cde-38q702) — STACK ACTUAL
═══════════════════════════════════════════════════════════════════════════

OS:                Debian GNU/Linux 13 (trixie) — version 13.5
Kernel:            6.12.88+deb13-amd64 (built 2026-05-15)
Container runtime: containerd 1.7.28
Kubelet:           v1.34.8
Architecture:      amd64

Paquetes:          433 paquetes Debian instalados
Kernel rollback:   linux-image-6.12.43+deb13 + 6.12.88+deb13 (ambos disponibles)

Último patch cycle: 2026-05-18 08:13:48 → 08:19:51 (6 min)
  - openssl, libssl3t64 → 3.5.6-1~deb13u1 (security)
  - openssh-server → 1:10.0p1-7+deb13u4 (security)
  - libcurl4t64 → 8.14.1-2+deb13u3 (security)
  - libxml2 → patched (security)
  - libnghttp2-14 → patched (security)
  - python3.13 → 3.13.5-2+deb13u2 (security)
  - bind9-libs → 9.20.21-1~deb13u1 (security)
  - sudo → 1.9.16p2-3+deb13u2 (security)
  - 50+ paquetes adicionales

═══════════════════════════════════════════════════════════════════════════
fintrix-pci-db (fintrix-production-fintrix-pci) — STACK ACTUAL
═══════════════════════════════════════════════════════════════════════════

ID:                061abee8-1d2c-49f4-be08-55f0054288cb
Engine:            PostgreSQL 16 (managed DBaaS)
Region:            nyc1
Size:              db-s-2vcpu-4gb
Storage:           60 GiB
Status:            online
Created:           2026-02-04T19:34:44Z

Maintenance window:
  Day:             Sunday
  Hour:            03:00 UTC
  Pending update:  True (próximo Sunday)

Backups:
  Frequency:       Daily 22:09 UTC
  Retention:       7 días por defecto + point-in-time recovery
  Last 4 backups:  2026-05-20 / 2026-05-21 / 2026-05-22 / 2026-05-23

═══════════════════════════════════════════════════════════════════════════
PROCESO DE PATCH MANAGEMENT (POL-006)
═══════════════════════════════════════════════════════════════════════════

CAPA               RESPONSABLE     MECHANISM            AUTOMATION
─────────────────  ──────────────  ──────────────────   ───────────
OS de los nodos    DigitalOcean    DOKS auto-upgrade    ✓ AUTO
Kernel             DigitalOcean    DOKS auto-upgrade    ✓ AUTO
Kubelet/Kubectl    DigitalOcean    DOKS auto-upgrade    ✓ AUTO
Containerd         DigitalOcean    DOKS auto-upgrade    ✓ AUTO
PostgreSQL engine  DigitalOcean    DBaaS auto-patch     ✓ AUTO
App dependencies   Fintrixs (CTO)  Dependabot + PR      ✓ AUTO PRs
Docker base imgs   Fintrixs (CTO)  Dependabot weekly    ✓ AUTO PRs
GitHub Actions     Fintrixs (CTO)  Dependabot weekly    ✓ AUTO PRs

DOKS Auto-upgrade config:
  auto_upgrade:  true
  surge_upgrade: true (zero-downtime)
  Window:        Sunday 04:00 UTC, max 4h duration

PLAZOS DE PATCH (SLA por severidad):
  P0 Critical (CVSS≥9.0, public):    24h     → CTO+CEO escalation
  P0 Critical (CVSS≥9.0, internal):  48h     → CTO escalation
  P1 High (CVSS 7.0-8.9, public):    7 días  → CTO escalation
  P1 High (CVSS 7.0-8.9, internal):  14 días
  P2 Medium (CVSS 4.0-6.9):          30-60 días
  P3 Low (CVSS <4.0):                90 días
  ★ CISA Known Exploited Vuln:       SIEMPRE P0 (24h)

═══════════════════════════════════════════════════════════════════════════
CONTENIDO DEL PAQUETE
═══════════════════════════════════════════════════════════════════════════

  00-README.txt              (este archivo)
  01-os-kernel.txt           Debian 13.5 + kernel 6.12.88
  02-runtime-versions.txt    K8s + containerd + nodeInfo JSON
  03-packages.txt            Paquetes Debian instalados (top críticos PCI)
  04-apt-history.txt         Apt history.log completo (deploy 2026-05-18)
  05-postgresql.txt          fintrix-pci-db version + maintenance + backups
  06-doks-cluster.txt        DOKS cluster spec + auto-upgrade config

═══════════════════════════════════════════════════════════════════════════
Fecha de extracción: 2026-05-27
Extraído por: Gabriel Ureña (CTO Fintrixs SAS)
═══════════════════════════════════════════════════════════════════════════
