[checkmk-commits] [tribe29/checkmk] c87b63: Use /omd/versions/../hooks for omd config hooks

Branch: refs/heads/2.0.0 Home: https://github.com/tribe29/checkmk Commit: c87b63e275a19d26e0b1549db4ccbb7d8e550f94 https://github.com/tribe29/checkmk/commit/c87b63e275a19d26e0b1549db4ccbb7d8… Author: Maximilian Wirtz &lt;maximilian.wirtz(a)tribe29.com&gt; Date: 2022-05-19 (Thu, 19 May 2022) Changed paths: A .werks/13902 M omd/packages/omd/omdlib/config_hooks.py M omd/packages/omd/omdlib/contexts.py Log Message: ----------- Use /omd/versions/../hooks for omd config hooks Omd executes several hooks to determin configuration options (e.g. which port to use for the Site-Apache). These hooks are version dependend, so omd executed these hooks via a symlink in the site to get the hooks matching the version of the site. The symlinks belong to the site user in order to be able to update the version. Since a <i>omd status</i> executes those hooks as root, it was possible for a site user to create a malicioious hook and execute code as root. All maintained versions (>=1.6) are subject to this vulnerability. It is likely that also previous versions were vulnerable. CVE will be added later here. We thank Timo Klecker for reporting this issue! CMK-10427 Change-Id: I3ad117773aa90b5a52ea4492ee37a66e48f3fb66