Title: host_config: can now move host between nested folders
Class: fix
Compatible: compat
Component: rest-api
Date: 1699258683
Edition: cre
Level: 1
Version: 2.3.0b1
This werk addresses an issue discovered when moving hosts to folders
that were more than one folder deep. Previously, the possible target
folders for the given host were incorrectly checked. We now have
a fix which will correctly check first if the target folder is
permitted.
Title: Remove Python 3.4 as an option for Windows Agent
Class: feature
Compatible: incomp
Component: agents
Date: 1694165426
Edition: cee
Knowledge: undoc
Level: 1
Version: 2.3.0b1
Older windows versions (e.g. Windows Server 2008 RC2) do not support Python versions newer than 3.4.
For these systems we offered the option to install Python 3.4.4 as a Python environment.
This environment was then used for various agent plugins.
Since Python 3.4 reached its end-of-life in 2019 and Windows Server 2008 RC2 its end-of-life in 2020 this support is now removed.
If you want to continue to run and monitor these systems you can still do that but if you use agent plugins that require Python you are now responsible for providing that environment.
Title: agent_elasticsearch: resolve error when requesting indices stats
Class: fix
Compatible: compat
Component: checks
Date: 1699277518
Edition: cre
Level: 1
Version: 2.3.0b1
There is a special error case which arises when trying to request the
indices stats from Elasticsearch which has at least one alias
pointing to a closed index. In the previous version, the special agent
completely failed in such scenarios. This werk resolves this by
requesting only the accessible indices.
Title: Support Diagnostics: Collect information about installed Python modules
Class: feature
Compatible: compat
Component: setup
Date: 1695825678
Edition: cre
Level: 1
Version: 2.3.0b1
The support Diagnostics dump now contains information about the Python modules that are
installed in the site context. It uses the command "pip freeze" to gather that information.
Title: agent-updater change behaviour of trust-cert option
Class: fix
Compatible: compat
Component: agents
Date: 1695817306
Edition: cee
Knowledge: doc
Level: 1
Version: 2.3.0b1
When registering the agent-updater and using the <tt>--trust-cert</tt> option the agent-updater used to traverse the certificate-chain and trust the first self-signed certificate in the chain which is usually a CA.
Unfortunately this relied on the server to provide the full certificate chain.
It is not uncommon to only provide the certificate and the corresponding intermediate CA certificate.
In these scenarios the agent-updater failed to trust the certificate.
Also the help text indicates that only the server certificate is trusted.
With this Werk the agent-updater retrieves the certificate of the server and trusts just that certificate.
Caution: If your registration workflow relies on an initial registration with <tt>--trust-cert</tt> option and you don't provide a certificate via another channel (see https://docs.checkmk.com/latest/en/agent_deployment.html#provide_certificat…), you'll now lose trust when changing the Checkmk server's server certificate.
If your workflow relies on the <tt>--trust-cert</tt> option, please make sure to provide a valid certificate via the agent updater ruleset or via global settings.
Werk 15713 was adapted. The following is the new Werk, a diff is shown at the end of the message.
Title: NagVis: Updated to 1.9.38
Class: security
Compatible: compat
Component: packages
Date: 1697312456
Edition: cre
Knowledge: doc
Level: 1
Version: 2.1.0p35
NagVis 1.9.38 fixes a XSS issue
<b>Vulnerability Management</b>:
We have rated the issue with a CVSS Score of 8.4 (High) with the following CVSS vector:
<tt>CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H 8.4</tt>.
CVE-2023-46287 was assigned to this issue.
<b>Changes</b>:
This Werk introduces escaping for the vulnerable parameter.
------------------------------------<diff>-------------------------------------------
Title: NagVis: Updated to 1.9.38
Class: security
Compatible: compat
Component: packages
Date: 1697312456
Edition: cre
Knowledge: doc
Level: 1
Version: 2.1.0p35
NagVis 1.9.38 fixes a XSS issue
<b>Vulnerability Management</b>:
We have rated the issue with a CVSS Score of 8.4 (High) with the following CVSS vector:
<tt>CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H 8.4</tt>.
+ CVE-2023-46287 was assigned to this issue.
+
<b>Changes</b>:
This Werk introduces escaping for the vulnerable parameter.
Werk 15713 was adapted. The following is the new Werk, a diff is shown at the end of the message.
Title: NagVis: Updated to 1.9.38
Class: security
Compatible: compat
Component: packages
Date: 1697312456
Edition: cre
Knowledge: doc
Level: 1
Version: 2.2.0p12
NagVis 1.9.38 fixes a XSS issue
<b>Vulnerability Management</b>:
We have rated the issue with a CVSS Score of 8.4 (High) with the following CVSS vector:
<tt>CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H 8.4</tt>.
CVE-2023-46287 was assigned to this issue.
<b>Changes</b>:
This Werk introduces escaping for the vulnerable parameter.
------------------------------------<diff>-------------------------------------------
Title: NagVis: Updated to 1.9.38
Class: security
Compatible: compat
Component: packages
Date: 1697312456
Edition: cre
Knowledge: doc
Level: 1
Version: 2.2.0p12
NagVis 1.9.38 fixes a XSS issue
<b>Vulnerability Management</b>:
We have rated the issue with a CVSS Score of 8.4 (High) with the following CVSS vector:
<tt>CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H 8.4</tt>.
+ CVE-2023-46287 was assigned to this issue.
+
<b>Changes</b>:
This Werk introduces escaping for the vulnerable parameter.
Title: dell_poweredge_status: crash on unknown state
Class: fix
Compatible: compat
Component: checks
Date: 1698738832
Edition: cre
Knowledge: doc
Level: 1
State: unknown
Version: 2.2.0p14
If the device returned an unknown state for <tt>globalSystemStatus</tt>
dell_poweredge_status crashed with error <tt>ValueError: not enough values to
unpack (expected 2, got 1)</tt>.
The new behavior is, that the service will be cirital and report <tt>unknown
state</tt> as system status.
Title: azure: adjustment of help text for App Registrations option
Class: fix
Compatible: compat
Component: checks
Date: 1698932842
Edition: cre
Knowledge: undoc
Level: 1
State: unknown
Version: 2.2.0p14
Prior to this werk, the help text for the Azure Datasource program
left out the 'App Registrations' as one of the options which require
graph API specific permissions. This is now added.