Checkmk werks level1 July 2024

checkmk-werks-lvl1@lists.checkmk.com

1 participants
398 discussions

[2.3.0] Checkmk Werk 16439 created: redis: Add Log Rotation

by Checkmk werks level 1

[//]: # (werk v2) # redis: Add Log Rotation key | value ---------- | --- date | 2024-07-08T06:33:26+00:00 version | 2.3.0p10 class | fix edition | cre component | omd level | 1 compatible | yes Previously, the file `var/log/redis-server.log` would not be rotated. If you are unable to upgrade, you can adjust the file in `$OMD_ROOT/etc/logrotate.d/redis`.

2 months, 1 week

[2.3.0] Checkmk Werk 16562 created: Fix automatic host removal in case one remote site is not logged in

by Checkmk werks level 1

[//]: # (werk v2) # Fix automatic host removal in case one remote site is not logged in key | value ---------- | --- date | 2024-07-08T06:09:01+00:00 version | 2.3.0p10 class | fix edition | cre component | wato level | 1 compatible | yes The automatic host removal job is executed regularly in the background to remove hosts from the monitoring once they cease to exist. In particular for but not limited to automatically registered hosts. This job failed in case one remote site was configured but not logged in, not only affecting the not logged in site, but all sites. The not logged in site is now being skipped, leaving the mechanism intact for all other sites.

2 months, 1 week

[2.4.0] Checkmk Werk 17074 adapted: msexch_database: Use consistent units (ms/s) in rules & graphs

by Checkmk werks level 1

Werk 17074 was adapted. The following is the new Werk, a diff is shown at the end of the message. [//]: # (werk v2) # msexch_database: Use consistent units (ms/s) in rules & graphs key | value ---------- | --- date | 2024-06-18T07:20:14+00:00 version | 2.4.0b1 class | fix edition | cee component | checks level | 1 compatible | yes The msexch_database reported its values in ms in the summary/ruleset but displayed the same value as seconds in the graph. With this werk, all units will be reported consistently. ------------------------------------<diff>------------------------------------------- [//]: # (werk v2) - # MS Exchange: Use consistent units (ms/s) in rules & graphs ? ^^^^ ^^ + # msexch_database: Use consistent units (ms/s) in rules & graphs ? ^^^ ++ ^^^^^ key | value ---------- | --- date | 2024-06-18T07:20:14+00:00 version | 2.4.0b1 class | fix edition | cee component | checks level | 1 compatible | yes - Various msexch_* checks reported its values in ms in the summary/ruleset ? ^^^^^^^ ^^^^ --- + The msexch_database reported its values in ms in the summary/ruleset but ? ^^^ ^^^^^^^ ++++ - but displayed the same value as seconds in the graph. With this werk, ? ---- + displayed the same value as seconds in the graph. With this werk, all ? ++++ - all units will be reported consistently. ? ---- + units will be reported consistently.

2 months, 1 week

[2.4.0] Checkmk Werk 17078 created: MS Exchange: Use consistent units (ms/s) in rules & graphs

by Checkmk werks level 1

[//]: # (werk v2) # MS Exchange: Use consistent units (ms/s) in rules & graphs key | value ---------- | --- compatible | yes version | 2.4.0b1 date | 2024-07-08T10:10:57+00:00 level | 1 class | fix component | checks edition | cre The checks msexch_isclienttype, msexch_isstore, msexch_rpcclientaccess reported their values in ms in the summary/ruleset but displayed the same value as seconds in the graph. With this werk, all MS Exchange checks now report their values consistently.

2 months, 1 week

[2.4.0] Checkmk Werk 16438 created: Filesystem: Use MiB instead of MB in Check Summary

by Checkmk werks level 1

[//]: # (werk v2) # Filesystem: Use MiB instead of MB in Check Summary key | value ---------- | --- date | 2024-07-04T09:29:10+00:00 version | 2.4.0b1 class | fix edition | cre component | checks level | 1 compatible | yes In version 2.3.0, the Filesystem Checks have been adapted to render bytes in the format `11.1 kb`. This has been changed back to `10.9 KiB`. This is how it was rendered in the 2.2.0. It also consistent with the graphs used by these checks.

2 months, 1 week

[2.4.0] Checkmk Werk 17063 created: Delete PDF tmp files older one day

by Checkmk werks level 1

[//]: # (werk v2) # Delete PDF tmp files older one day key | value ---------- | --- date | 2024-07-08T07:04:56+00:00 version | 2.4.0b1 class | fix edition | cre component | wato level | 1 compatible | yes Werk #15125 introduced a cleanup mechanism for old PFD tmp files but deleted files older 48hours. Now files older than one day are deleted.

2 months, 1 week

[2.4.0] Checkmk Werk 16434 adapted: Synthetic Monitoring: Privilege Escalation

by Checkmk werks level 1

Werk 16434 was adapted. The following is the new Werk, a diff is shown at the end of the message. [//]: # (werk v2) # Synthetic Monitoring: Privilege Escalation key | value ---------- | --- date | 2024-06-24T14:56:31+00:00 version | 2.4.0b1 class | security edition | cee component | agents level | 1 compatible | yes The Robotmk scheduler was affected by a privilege escalation issue. This issue affects users, which have configured the rule `Robotmk scheduler (Windows)`. Specifically, an attacker is able to exploit the issue, if 1. `Automated environment setup (via RCC)` was configured in the `Robotmk scheduler (Windows)` rule, 2. the same plan was configured without configuring `Execute plan as a specific user` 3. and a user on the host, onto which the scheduler has been deployed, was compromised. In this event, the attacker could gain SYSTEM privileges on the host. If `Execute plan as a specific user` _is_ configured, then the attacker could compromise that specific user, rather than SYSTEM. There is a second similar, but distinct issue. If - there are two or more plans configured with `Execute plan as a specific user` with distinct users - and one of the configured users was already compromised. The attacker could then compromise the other user. *Background*: The Robotmk scheduler is started by the Checkmk agent that runs with SYSTEM privileges. Moreover, Robotmk allows the user to automatically build Python environments via RCC. During setup the scheduler would enable a RCC feature called `shared holotree usage`. This feature allows all users on the host to edit these Python environments. Thus, any compromised user on the host is also able to compromise a user, which executes code from these shared environments. With this Werk, `shared holotree usage` will no longer be enabled. Affected users will have their access to the vulnerable Python environments revoked. Moreover, the permissions inside of the working directory of Robotmk have been reworked. Users now only have access to directories, which are required for their own executions. Note, you must update both Checkmk and redeploy the latest Robotmk Scheduler. *Affected Versions*: * 2.3.0 *Mitigations*: If updating is not possible: * Do not use the rule `Automated environment setup (via RCC)`. * Always use the same user for `Execute plan as a specific user`. *Vulnerability Management*: We have rated the issue with a CVSS Score of 7.8 (High) with the following CVSS vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. CVE-2024-39934 has been assigned to this issue. ------------------------------------<diff>------------------------------------------- [//]: # (werk v2) # Synthetic Monitoring: Privilege Escalation key | value ---------- | --- date | 2024-06-24T14:56:31+00:00 version | 2.4.0b1 class | security edition | cee component | agents level | 1 compatible | yes The Robotmk scheduler was affected by a privilege escalation issue. This issue affects users, which have configured the rule `Robotmk scheduler (Windows)`. Specifically, an attacker is able to exploit the issue, if 1. `Automated environment setup (via RCC)` was configured in the `Robotmk scheduler (Windows)` rule, 2. the same plan was configured without configuring `Execute plan as a specific user` 3. and a user on the host, onto which the scheduler has been deployed, was compromised. In this event, the attacker could gain SYSTEM privileges on the host. If `Execute plan as a specific user` _is_ configured, then the attacker could compromise that specific user, rather than SYSTEM. There is a second similar, but distinct issue. If - there are two or more plans configured with `Execute plan as a specific user` with distinct users - and one of the configured users was already compromised. The attacker could then compromise the other user. *Background*: The Robotmk scheduler is started by the Checkmk agent that runs with SYSTEM privileges. Moreover, Robotmk allows the user to automatically build Python environments via RCC. During setup the scheduler would enable a RCC feature called `shared holotree usage`. This feature allows all users on the host to edit these Python environments. Thus, any compromised user on the host is also able to compromise a user, which executes code from these shared environments. With this Werk, `shared holotree usage` will no longer be enabled. Affected users will have their access to the vulnerable Python environments revoked. Moreover, the permissions inside of the working directory of Robotmk have been reworked. Users now only have access to directories, which are required for their own executions. Note, you must update both Checkmk and redeploy the latest Robotmk Scheduler. *Affected Versions*: * 2.3.0 *Mitigations*: If updating is not possible: * Do not use the rule `Automated environment setup (via RCC)`. * Always use the same user for `Execute plan as a specific user`. *Vulnerability Management*: We have rated the issue with a CVSS Score of 7.8 (High) with the following CVSS vector: - `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` and requested a CVE. ? -------------------- + `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. + CVE-2024-39934 has been assigned to this issue.

2 months, 1 week

[2.4.0] Checkmk Werk 16439 created: redis: Add Log Rotation

by Checkmk werks level 1

[//]: # (werk v2) # redis: Add Log Rotation key | value ---------- | --- date | 2024-07-08T06:33:26+00:00 version | 2.4.0b1 class | fix edition | cre component | omd level | 1 compatible | yes Previously, the file `var/log/redis-server.log` would not be rotated. If you are unable to upgrade, you can adjust the file in `$OMD_ROOT/etc/logrotate.d/redis`.

2 months, 1 week

[2.4.0] Checkmk Werk 16562 created: Fix automatic host removal in case one remote site is not logged in

by Checkmk werks level 1

[//]: # (werk v2) # Fix automatic host removal in case one remote site is not logged in key | value ---------- | --- date | 2024-07-08T06:09:01+00:00 version | 2.4.0b1 class | fix edition | cre component | wato level | 1 compatible | yes The automatic host removal job is executed regularly in the background to remove hosts from the monitoring once they cease to exist. In particular for but not limited to automatically registered hosts. This job failed in case one remote site was configured but not logged in, not only affecting the not logged in site, but all sites. The not logged in site is now being skipped, leaving the mechanism intact for all other sites.

2 months, 1 week

[2.1.0] Checkmk Werk 17092 created: Fix missing CSRF token issues

by Checkmk werks level 1

Title: Fix missing CSRF token issues Class: fix Compatible: compat Component: wato Date: 1719997630 Edition: cre Level: 1 Version: 2.1.0p45 Werk #17090 in Checkmk 2.3.0p8 and 2.2.0p29 introduced additional CSRF token checks in the GUI. This caused some buttons to not work anymore because the CSRF token was missing, including, but likely not limited to: LI: "Synchronize users" in Setup > Users to manually trigger the LDAP sync (the background sync still runs) LI: "Show analysis" and "Show bulks" in Setup > Events > Notifications LI: Reordering notification rules via drag-and-drop in the same view LI: "Bake agents" in the agent bakery (as a workaround, use "Bake and sign agents") LI: "Acknowledge last baking result" when a bake job failed (as a workaround, delete the failed job instead) This Werk fixes the issues by adding the token.

2 months, 2 weeks

← Newer
1
...
27
28
29
30
31
32
33
...
40
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level1 July 2024