[checkmk-commits] [tribe29/checkmk] d06f07: 13321 SEC NagVis: Updated to 1.9.29 (Fix possible ...

Branch: refs/heads/2.0.0 Home: https://github.com/tribe29/checkmk Commit: d06f07df4e5096d8e387b612dc1a9b2ce03fb59d https://github.com/tribe29/checkmk/commit/d06f07df4e5096d8e387b612dc1a9b2ce… Author: Lars Michelsen <lm(a)tribe29.com> Date: 2021-12-13 (Mon, 13 Dec 2021) Changed paths: A .werks/13321 R omd/packages/nagvis/nagvis-1.9.28.tar.gz A omd/packages/nagvis/nagvis-1.9.29.tar.gz M omd/packages/nagvis/nagvis.make M omd/packages/nagvis/update-nagvis Log Message: ----------- 13321 SEC NagVis: Updated to 1.9.29 (Fix possible deletion of arbitrary files) Fix possible deletion of arbitrary files (CVE-2021-33178). An authenticated user with enough permissions to access the NagVis. ManageBackgrounds endpoint, such as admin, can delete arbitrary files on the server limited by the rights of the Apache system user. In Checkmk, this is limited to files owned by the site user. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33178 Change-Id: I4a88322a91e8b4ba86f662a09133d068c548e586