[checkmk-commits] [tribe29/checkmk] 2079bf: 15069 SEC Fix Email HTML Injection

Branch: refs/heads/2.1.0 Home: https://github.com/tribe29/checkmk Commit: 2079bf580f7a4b7580d3d8b5a7d3298776198a54 https://github.com/tribe29/checkmk/commit/2079bf580f7a4b7580d3d8b5a7d329877… Author: Maximilian Wirtz &lt;maximilian.wirtz(a)tribe29.com&gt; Date: 2023-03-20 (Mon, 20 Mar 2023) Changed paths: A .werks/15069 M cmk/gui/http.py M cmk/gui/main.py M cmk/gui/plugins/sidebar/bookmarks.py M cmk/gui/plugins/userdb/utils.py M cmk/gui/utils/__init__.py M cmk/gui/utils/escaping.py M cmk/gui/valuespec.py M cmk/notification_plugins/utils.py A cmk/utils/escaping.py A cmk/utils/urls.py R tests/unit/cmk/gui/utils/test_init.py M tests/unit/cmk/notifications/test_notification_plugins_utils.py A tests/unit/cmk/utils/test_escaping.py A tests/unit/cmk/utils/test_urls.py Log Message: ----------- 15069 SEC Fix Email HTML Injection Previously an authenticated attacker with permissions to configure HTML notifications was able to inject HTML into E-Mails via <i>Insert HTML section between body and table</i>. All versions up to 1.6. are subject to this vulnerability. To detect previous exploitation of this vulnerability one can check <tt>etc/check_mk/conf.d/wato/notifications.mk</tt>. Search for <tt>insert_html_section</tt> and malicious HTML. This vulnerability was found internally. We calculated a CVSS3.1 score of 4.1 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N and assigned CVE-2023-22288. This pick also includes these master changes: - I56c6070e20d0af9dfcc914536ed6a764fce14838 (Move is_allowed_url to cmk.utils.urls) - I70815426d5fd016b52678f54913c36220baeed77 (Move some escaping functions to cmk.utils.escaping) Change-Id: Ia186b9c710d83d4f063a3de09c6ef78af63b8381