Branch: refs/heads/2.0.0
Home:
https://github.com/tribe29/checkmk
Commit: d06f07df4e5096d8e387b612dc1a9b2ce03fb59d
https://github.com/tribe29/checkmk/commit/d06f07df4e5096d8e387b612dc1a9b2ce…
Author: Lars Michelsen <lm(a)tribe29.com>
Date: 2021-12-13 (Mon, 13 Dec 2021)
Changed paths:
A .werks/13321
R omd/packages/nagvis/nagvis-1.9.28.tar.gz
A omd/packages/nagvis/nagvis-1.9.29.tar.gz
M omd/packages/nagvis/nagvis.make
M omd/packages/nagvis/update-nagvis
Log Message:
-----------
13321 SEC NagVis: Updated to 1.9.29 (Fix possible deletion of arbitrary files)
Fix possible deletion of arbitrary files (CVE-2021-33178).
An authenticated user with enough permissions to access the NagVis.
ManageBackgrounds endpoint, such as admin, can delete arbitrary files on the
server limited by the rights of the Apache system user. In Checkmk, this is
limited to files owned by the site user.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33178
Change-Id: I4a88322a91e8b4ba86f662a09133d068c548e586