Branch: refs/heads/master
Home:
https://github.com/tribe29/checkmk
Commit: 1bc0d82e42569d0c6400cf542f2647b17bbb9af9
https://github.com/tribe29/checkmk/commit/1bc0d82e42569d0c6400cf542f2647b17…
Author: Lars Michelsen <lm(a)tribe29.com>
Date: 2021-12-13 (Mon, 13 Dec 2021)
Changed paths:
A .werks/13321
R omd/packages/nagvis/nagvis-1.9.28.tar.gz
A omd/packages/nagvis/nagvis-1.9.29.tar.gz
M omd/packages/nagvis/nagvis.make
M omd/packages/nagvis/update-nagvis
Log Message:
-----------
13321 SEC NagVis: Updated to 1.9.29 (Fix possible deletion of arbitrary files)
Fix possible deletion of arbitrary files (CVE-2021-33178).
An authenticated user with enough permissions to access the NagVis.
ManageBackgrounds endpoint, such as admin, can delete arbitrary files on the
server limited by the rights of the Apache system user. In Checkmk, this is
limited to files owned by the site user.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33178
Change-Id: I4a88322a91e8b4ba86f662a09133d068c548e586