Branch: refs/heads/master
Home:
https://github.com/Checkmk/checkmk
Commit: 8a3f6af31873b17054fd2208dcd356eadd5a29b8
https://github.com/Checkmk/checkmk/commit/8a3f6af31873b17054fd2208dcd356ead…
Author: Matteo Stifano <matteo.stifano(a)checkmk.com>
Date: 2024-06-14 (Fri, 14 Jun 2024)
Changed paths:
M tests/update/conftest.py
Log Message:
-----------
test_update: Improve logging
Change-Id: I28db79caf3eff715a48c6da223ff7412867703bd
Commit: 00ad8f06496d630c14bcb8d0ae67883ec11fecd7
https://github.com/Checkmk/checkmk/commit/00ad8f06496d630c14bcb8d0ae67883ec…
Author: Maximilian Wirtz <maximilian.wirtz(a)checkmk.com>
Date: 2024-06-14 (Fri, 14 Jun 2024)
Changed paths:
A .werks/17009.md
M cmk/gui/views/inventory/_tree_renderer.py
Log Message:
-----------
17009 SEC XSS in inventory tree
Prior to this Werk an attacker with control over an agent was able to inject HTML in the
output which was then rendered in the inventory tree of the coresponding host.
This problem exists only if the rule *Do hardware/software inventory* is set for the
compromised agent/host.
We found this vulnerability internally.
**Affected Versions:**
* 2.3.0
* 2.2.0
* 2.1.0
* 2.0.0
**Mitigations**:
If you are unable to patch you can disable inventory scanning for all hosts.
**Indicators of Compromise:**
You can check `var/check_mk/inventory/` for inventories with embedded HTML.
This only indicates current 'attacks'.
Previous attacks (where the agent does not output the payload anymore) are not
discoverable after some time (caching).
**Vulnerability Management:**
We have rated the issue with a CVSS Score of 6.5 (Medium) with the following CVSS vector:
`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L`
We assigned CVE-2024-5741 to this vulnerability.
**Changes:**
This Werk adds sanitation to the HTML output.
Change-Id: I5b93ac74128384c910fb17c54906bd62ee785d34
Compare:
https://github.com/Checkmk/checkmk/compare/e0eb2965fc86...00ad8f06496d
To unsubscribe from these emails, change your notification settings at
https://github.com/Checkmk/checkmk/settings/notifications