Checkmk werks level1 June 2024

checkmk-werks-lvl1@lists.checkmk.com

1 participants
272 discussions

[2.1.0] Checkmk Werk 17024 created: Fix XSS in Crash Report Page

by Checkmk werks level 1

Title: Fix XSS in Crash Report Page Class: security Compatible: compat Component: wato Date: 1717679856 Edition: cre Level: 1 Version: 2.1.0p45 Prior to this Werk, it was possible to inject HTML elements into Crash report URL in the Global settings, leading to an <code>XSS</code> vulnerability in the Crash reports page. This vulnerability was identified during a commissioned penetration test conducted by PS Positive Security GmbH. Affected Versions: LI: 2.3.0 LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) Indicators of Compromise: Check the crash report HTTP URL in the Global settings for suspicious HTML elements. Vulnerability Management: We have rated the issue with a CVSS Score of 4.8 Medium with the following CVSS vector: <code>CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N</code>. and assigned <code>CVE-2024-28832</code>.

3 months

[2.2.0] Checkmk Werk 17056 created: Don't show automation secret in the audit log (addresses CVE-2024-28830)

by Checkmk werks level 1

Title: Don't show automation secret in the audit log (addresses CVE-2024-28830) Class: security Compatible: incomp Component: wato Date: 1718799000 Edition: cre Level: 2 Version: 2.2.0p28 By default only admin users are able to see the audit log. Guests and normal monitoring users do not have acces to the audit log. Werk #13330 already fixed a problem where passwords were shown in the audit log. This werk now addresses the problem, that still automation secrets of automation user were logged in clear text to the audit log, e.g. on change of the automation secret via REST-API or the user interface. Existing automation secrets in the audit log should be removed automatically during the update but please double check that no automation secrets remain in the log (see next paragraph for details). A backup of the original audit log (before automation secrets were removed) is copied to "~/var/check_mk/wato/log/sanitize_backup". If anything goes wrong during the update, you have to copy the files back to ~var/check_mk/wato/log and remove the automation secrets manually. If the update works as expected, you can remove the backup files. In distributed setups which do not replicate the configuration, automation secrets are replaced during the update of each site. In setups which replicate the configuration from central to remote sites no automation secrets should be present in the logs of the remote site, since only information about the activation is logged. Only if you switched to a replicated setup after the upgrade to the 2.0, automation secrets can be present in the logs. Since automation secrets may be in this scenario as well, the steps described before also apply. Affected Versions: LI: 2.3.0 LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) Mitigations: Remove automation secrets manually within the files located in ~var/check_mk/wato/log. Vulnerability Management: We have rated the issue with a CVSS Score of <2.7 (Low)> with the following CVSS vector: <code>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N</code> and assigned CVE <code>CVE-2024-28830</code>.

3 months

[2.2.0] Checkmk Werk 17055 created: Fix unescaped details for process discovery checks in "Log: Details" column

by Checkmk werks level 1

Title: Fix unescaped details for process discovery checks in "Log: Details" column Class: fix Compatible: compat Component: multisite Date: 1718713873 Edition: cre Level: 1 Version: 2.2.0p28 Werk #16701 already fixed the escaping for availability views. This werk fixes the escaping in views with "Log: Details" columns. If the long output is truncated, there will be a warning because we can not render the table without the complete table styling, which is missing in that case.

3 months

[2.2.0] Checkmk Werk 17074 created: MS Exchange: Use consistent units (ms/s) in rules & graphs

by Checkmk werks level 1

Title: MS Exchange: Use consistent units (ms/s) in rules & graphs Class: fix Compatible: compat Component: checks Date: 1718695214 Edition: cee Level: 1 Version: 2.2.0p28 Various msexch_* checks reported its values in ms in the summary/ruleset but displayed the same value as seconds in the graph. With this werk, all units will be reported consistently.

3 months

[2.2.0] Checkmk Werk 17030 created: huawei_osn_laser: Fix parsing issue

by Checkmk werks level 1

Title: huawei_osn_laser: Fix parsing issue Class: fix Compatible: compat Component: checks Date: 1718637633 Edition: cre Level: 1 Version: 2.2.0p28 Fixed a parsing issue in the huawei_osn_laser check plugin. The problem appeared every time a serivce was supposed to have an OK state and caused the check plugin to crash, and thus not deliver any result. The crash report ended with this line: C+: if "\n" in subresult[1]: C-: This has now been fixed.

3 months

[2.2.0] Checkmk Werk 17025 created: Fix XSS in confirmation pop-up

by Checkmk werks level 1

Title: Fix XSS in confirmation pop-up Class: security Compatible: compat Component: wato Date: 1718016028 Edition: cre Level: 1 Version: 2.2.0p28 Prior to this Werk, there was a potential for HTML elements from user inputs to be rendered in certain confirmation pop-ups, leading to an XSS vulnerability. This vulnerability was identified during a commissioned penetration test conducted by PS Positive Security GmbH. Affected Versions: LI: 2.3.0 LI: 2.2.0 Indicators of Compromise: Injected HTML elements in some specific user input fields with no proper escaping that are displayed in the confirmation pop-up. Vulnerability Management: We have rated the issue with a CVSS Score of 5.4 Medium with the following CVSS vector: <code>CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</code>, and assigned <code>CVE-2024-28831</code>.

3 months

[2.2.0] Checkmk Werk 17024 created: Fix XSS in Crash Report Page

by Checkmk werks level 1

Title: Fix XSS in Crash Report Page Class: security Compatible: compat Component: wato Date: 1717679856 Edition: cre Level: 1 Version: 2.2.0p28 Prior to this Werk, it was possible to inject HTML elements into Crash report URL in the Global settings, leading to an <code>XSS</code> vulnerability in the Crash reports page. This vulnerability was identified during a commissioned penetration test conducted by PS Positive Security GmbH. Affected Versions: LI: 2.3.0 LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) Indicators of Compromise: Check the crash report HTTP URL in the Global settings for suspicious HTML elements. Vulnerability Management: We have rated the issue with a CVSS Score of 4.8 Medium with the following CVSS vector: <code>CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N</code>. and assigned <code>CVE-2024-28832</code>.

3 months

[2.3.0] Checkmk Werk 17055 created: Fix unescaped details for process discovery checks in "Log: Details" column

by Checkmk werks level 1

[//]: # (werk v2) # Fix unescaped details for process discovery checks in "Log: Details" column key | value ---------- | --- compatible | yes version | 2.3.0p7 date | 2024-06-18T12:31:13+00:00 level | 1 class | fix component | multisite edition | cre Werk #16701 already fixed the escaping for availability views. This werk fixes the escaping in views with "Log: Details" columns. If the long output is truncated, there will be a warning because we can not render the table without the complete table styling, which is missing in that case.

3 months

[2.3.0] Checkmk Werk 17074 created: MS Exchange: Use consistent units (ms/s) in rules & graphs

by Checkmk werks level 1

[//]: # (werk v2) # MS Exchange: Use consistent units (ms/s) in rules & graphs key | value ---------- | --- date | 2024-06-18T07:20:14+00:00 version | 2.3.0p7 class | fix edition | cee component | checks level | 1 compatible | yes Various msexch_* checks reported its values in ms in the summary/ruleset but displayed the same value as seconds in the graph. With this werk, all units will be reported consistently.

3 months

[2.3.0] Checkmk Werk 17056 created: Don't show automation secret in the audit log (addresses CVE-2024-28830)

by Checkmk werks level 1

[//]: # (werk v2) # Don't show automation secret in the audit log (addresses CVE-2024-28830) key | value ---------- | --- date | 2024-06-19T12:10:00+00:00 version | 2.3.0p7 class | security edition | cre component | wato level | 2 compatible | no By default only admin users are able to see the audit log. Guests and normal monitoring users do not have acces to the audit log. Werk #13330 already fixed a problem where passwords were shown in the audit log. This werk now addresses the problem, that still automation secrets of automation user were logged in clear text to the audit log, e.g. on change of the automation secret via REST-API or the user interface. Existing automation secrets in the audit log should be removed automatically during the update but please double check that no automation secrets remain in the log (see next paragraph for details). A backup of the original audit log (before automation secrets were removed) is copied to "~/var/check_mk/wato/log/sanitize_backup". If anything goes wrong during the update, you have to copy the files back to ~var/check_mk/wato/log and remove the automation secrets manually. If the update works as expected, you can remove the backup files. In distributed setups which do not replicate the configuration, automation secrets are replaced during the update of each site. In setups which replicate the configuration from central to remote sites no automation secrets should be present in the logs of the remote site, since only information about the activation is logged. Only if you switched to a replicated setup after the upgrade to the 2.0, automation secrets can be present in the logs. Since automation secrets may be in this scenario as well, the steps described before also apply. *Affected Versions*: * 2.3.0 * 2.2.0 * 2.1.0 * 2.0.0 (EOL) *Mitigations*: Remove automation secrets manually within the files located in ~var/check_mk/wato/log. *Vulnerability Management*: We have rated the issue with a CVSS Score of <2.7 (Low)> with the following CVSS vector: `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N` and assigned CVE `CVE-2024-28830`.

3 months

← Newer
1
...
6
7
8
9
10
11
12
...
28
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level1 June 2024