Checkmk werks level1 July 2024

checkmk-werks-lvl1@lists.checkmk.com

1 participants
398 discussions

[2.2.0] Checkmk Werk 17059 created: Escape user input on load failure of visuals

by Checkmk werks level 1

Title: Escape user input on load failure of visuals Class: security Compatible: compat Component: multisite Date: 1719397057 Edition: cre Level: 1 Version: 2.2.0p28 An attacker could create phishing links that take Checkmk users to their Checkmk installation and lure them into a malicious link if a visual (view/dashboard/report) did not exist. Affected Versions: LI: 2.3.0 LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) Vulnerability Management: We have rated the issue with a CVSS Score of <4.3 (Medium)> with the following CVSS vector: <code>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</code> and assigned CVE <code>CVE-2024-38857</code>.

2 months, 2 weeks

[2.2.0] Checkmk Werk 16068 created: SIGNL4: better support of service alerting and two-way status updates

by Checkmk werks level 1

Title: SIGNL4: better support of service alerting and two-way status updates Class: fix Compatible: compat Component: notifications Date: 1698405465 Edition: cre Level: 1 Version: 2.2.0p28

2 months, 2 weeks

[2.3.0] Checkmk Werk 16999 created: Service check commands exclamation mark is no more escaped

by Checkmk werks level 1

[//]: # (werk v2) # Service check commands exclamation mark is no more escaped key | value ---------- | --- date | 2024-06-03T07:19:18+00:00 version | 2.3.0p8 class | fix edition | cre component | multisite level | 1 compatible | yes Previously instead of "!" the GUI displayed "\!" when rendering a service check command. This is fixed to rendering unescaped service check commands to the GUI.

2 months, 2 weeks

[2.3.0] Checkmk Werk 17059 created: Escape user input on load failure of visuals

by Checkmk werks level 1

[//]: # (werk v2) # Escape user input on load failure of visuals key | value ---------- | --- date | 2024-06-26T10:17:37+00:00 version | 2.3.0p8 class | security edition | cre component | multisite level | 1 compatible | yes An attacker could create phishing links that take Checkmk users to their Checkmk installation and lure them into a malicious link if a visual (view/dashboard/report) did not exist. Affected Versions: LI: 2.3.0 LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) Vulnerability Management: We have rated the issue with a CVSS Score of <4.3 (Medium)> with the following CVSS vector: <code>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</code> and assigned CVE <code>CVE-2024-38857</code>.

2 months, 2 weeks

[2.3.0] Checkmk Werk 16717 created: Fix DCD creation using the Rest API

by Checkmk werks level 1

[//]: # (werk v2) # Fix DCD creation using the Rest API key | value ---------- | --- date | 2024-06-28T12:06:10+00:00 version | 2.3.0p8 class | fix edition | cee component | rest-api level | 1 compatible | yes When creating a DCD using the Rest API, the hour and minutes of the exculded times were saved in an incorrect format, causing the GUI to crash. This werk fixes the problem and the fields are now saved as integers instead of strings.

2 months, 2 weeks

[2.4.0] Checkmk Werk 16787 created: ldap: users should be created without the suffix unless there are conflicts

by Checkmk werks level 1

[//]: # (werk v2) # ldap: users should be created without the suffix unless there are conflicts key | value ---------- | --- date | 2024-06-05T12:24:08+00:00 version | 2.4.0b1 class | fix edition | cre component | wato level | 1 compatible | yes Previously, if you had an ldap connection configured with both a "suffix" and "create users only on login" enabled. The username used to login would be used to create a user profile. E.g. * testuser1 -> created a userprofile called testuser1 * testuser1@suffix -> created a userprofile called testuser1@suffix This was incorrect. The suffix should only be used when there are conflicts. This werk addresses this issue by changing the behaviour to: * Check if the user (without the suffix) already exists. * If it's the same user, login with this user. No need to create a new user profile. * If it's a different user, repeat the process using the username with the suffix.

2 months, 2 weeks

[2.4.0] Checkmk Werk 17059 created: Escape user input on load failure of visuals

by Checkmk werks level 1

[//]: # (werk v2) # Escape user input on load failure of visuals key | value ---------- | --- date | 2024-06-26T10:17:37+00:00 version | 2.4.0b1 class | security edition | cre component | multisite level | 1 compatible | yes An attacker could create phishing links that take Checkmk users to their Checkmk installation and lure them into a malicious link if a visual (view/dashboard/report) did not exist. Affected Versions: LI: 2.3.0 LI: 2.2.0 LI: 2.1.0 LI: 2.0.0 (EOL) Vulnerability Management: We have rated the issue with a CVSS Score of <4.3 (Medium)> with the following CVSS vector: <code>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</code> and assigned CVE <code>CVE-2024-38857</code>.

2 months, 2 weeks

[2.4.0] Checkmk Werk 16717 created: Fix DCD creation using the Rest API

by Checkmk werks level 1

[//]: # (werk v2) # Fix DCD creation using the Rest API key | value ---------- | --- date | 2024-06-28T12:06:10+00:00 version | 2.4.0b1 class | fix edition | cee component | rest-api level | 1 compatible | yes When creating a DCD using the Rest API, the hour and minutes of the exculded times were saved in an incorrect format, causing the GUI to crash. This werk fixes the problem and the fields are now saved as integers instead of strings.

2 months, 2 weeks

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level1 July 2024