Branch: refs/heads/1.6.0
Home:
https://github.com/tribe29/checkmk
Commit: 71927f0a9cadf8cde8ef2826e63efc618ab96aeb
https://github.com/tribe29/checkmk/commit/71927f0a9cadf8cde8ef2826e63efc618…
Author: Lars Michelsen <lm(a)tribe29.com>
Date: 2021-12-11 (Sat, 11 Dec 2021)
Changed paths:
A .werks/13321
R omd/packages/nagvis/nagvis-1.9.25.tar.gz
A omd/packages/nagvis/nagvis-1.9.29.tar.gz
M omd/packages/nagvis/nagvis.make
Log Message:
-----------
13321 SEC NagVis: Updated to 1.9.29 (Fix possible deletion of arbitrary files)
Fix possible deletion of arbitrary files (CVE-2021-33178).
An authenticated user with enough permissions to access the NagVis.
ManageBackgrounds endpoint, such as admin, can delete arbitrary files on the
server limited by the rights of the Apache system user. In Checkmk, this is
limited to files owned by the site user.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33178
Change-Id: I4a88322a91e8b4ba86f662a09133d068c548e586