Checkmk werks level1 September 2024

checkmk-werks-lvl1@lists.checkmk.com

1 participants
87 discussions

[2.2.0] Checkmk Werk 17094 created: Fix XSS on SAML login screen

by Checkmk werks level 1

Title: Fix XSS on SAML login screen Class: security Compatible: compat Component: wato Date: 1725549833 Edition: cee Level: 1 Version: 2.2.0p34 Prior to Werk, attackers could craft URLs that rendered clickable HTML links in the error box on the SAML login page. This could facilitate phishing attacks by tricking users into clicking malicious links. Links in the error message are now escaped and no longer clickable. This issue was identified during internal review. <em>Affected Versions</em>: LI: 2.3.0 LI: 2.2.0 <em>Vulnerability Management</em>: We have rated the issue with a CVSS Score of 5.1 Medium (<code>CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N</code>) and assigned <code>CVE-2024-38860</code>.

5 hours, 58 minutes

[2.2.0] Checkmk Werk 17191 created: mk_docker.py: Don't crash if a devices '/sys/block/DEVICE/dev' is missing

by Checkmk werks level 1

Title: mk_docker.py: Don't crash if a devices '/sys/block/DEVICE/dev' is missing Class: fix Compatible: compat Component: checks Date: 1726050962 Edition: cre Level: 1 Version: 2.2.0p34

5 hours, 58 minutes

[2.3.0] Checkmk Werk 17094 created: Fix XSS on SAML login screen

by Checkmk werks level 1

[//]: # (werk v2) # Fix XSS on SAML login screen key | value ---------- | --- date | 2024-09-05T15:23:53+00:00 version | 2.3.0p16 class | security edition | cee component | wato level | 1 compatible | yes Prior to Werk, attackers could craft URLs that rendered clickable HTML links in the error box on the SAML login page. This could facilitate phishing attacks by tricking users into clicking malicious links. Links in the error message are now escaped and no longer clickable. This issue was identified during internal review. *Affected Versions*: * 2.3.0 * 2.2.0 *Vulnerability Management*: We have rated the issue with a CVSS Score of 5.1 Medium (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N`) and assigned `CVE-2024-38860`.

5 hours, 59 minutes

[2.3.0] Checkmk Werk 16894 created: ups_*: support for NetVision OIDs

by Checkmk werks level 1

[//]: # (werk v2) # ups_*: support for NetVision OIDs key | value ---------- | --- compatible | yes version | 2.3.0p16 date | 2024-09-10T14:20:45+00:00 level | 1 class | fix component | checks edition | cre Newer firmware for NetVision cards was not supported due to changed SNMP OIDs for UPS entries. This change adds `.1.3.6.1.4.1.4555.1.1.7` and `.1.3.6.1.4.1.42610.1.4.4` to the detection lists.

6 hours

[2.3.0] Checkmk Werk 17191 created: mk_docker.py: Don't crash if a devices '/sys/block/DEVICE/dev' is missing

by Checkmk werks level 1

[//]: # (werk v2) # mk_docker.py: Don't crash if a devices '/sys/block/DEVICE/dev' is missing key | value ---------- | --- date | 2024-09-11T10:36:02+00:00 version | 2.3.0p16 class | fix edition | cre component | checks level | 1 compatible | yes

6 hours

[2.3.0] Checkmk Werk 16893 created: pure_storage_fa_volumes: protocol_endpoints result in DivisionByZero exception

by Checkmk werks level 1

[//]: # (werk v2) # pure_storage_fa_volumes: protocol_endpoints result in DivisionByZero exception key | value ---------- | --- date | 2024-09-10T12:53:22+00:00 version | 2.3.0p16 class | fix edition | cre component | checks level | 1 compatible | yes Running `pure_storage_fa_volumes` on a `protocol_endpoints` entry resulted in a DivisionByZero exception being thrown due to `total_provisioned` being 0. This change makes `pure_storage_fa_volumes` skip `protocol_endpoint` entirely

6 hours, 1 minute

[2.4.0] Checkmk Werk 17094 created: Fix XSS on SAML login screen

by Checkmk werks level 1

[//]: # (werk v2) # Fix XSS on SAML login screen key | value ---------- | --- date | 2024-09-05T15:23:53+00:00 version | 2.4.0b1 class | security edition | cee component | wato level | 1 compatible | yes Prior to Werk, attackers could craft URLs that rendered clickable HTML links in the error box on the SAML login page. This could facilitate phishing attacks by tricking users into clicking malicious links. Links in the error message are now escaped and no longer clickable. This issue was identified during internal review. *Affected Versions*: * 2.3.0 * 2.2.0 *Vulnerability Management*: We have rated the issue with a CVSS Score of 5.1 Medium (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N`) and assigned `CVE-2024-38860`.

6 hours, 1 minute

[2.4.0] Checkmk Werk 16894 created: ups_*: support for NetVision OIDs

by Checkmk werks level 1

[//]: # (werk v2) # ups_*: support for NetVision OIDs key | value ---------- | --- compatible | yes version | 2.4.0b1 date | 2024-09-10T14:20:45+00:00 level | 1 class | fix component | checks edition | cre Newer firmware for NetVision cards was not supported due to changed SNMP OIDs for UPS entries. This change adds `.1.3.6.1.4.1.4555.1.1.7` and `.1.3.6.1.4.1.42610.1.4.4` to the detection lists.

6 hours, 2 minutes

[2.4.0] Checkmk Werk 17207 created: omd update: Reintroduce Log "Verifying site configuration"

by Checkmk werks level 1

[//]: # (werk v2) # omd update: Reintroduce Log "Verifying site configuration" key | value ---------- | --- date | 2024-09-14T17:24:51+00:00 version | 2.4.0b1 class | fix edition | cre component | omd level | 1 compatible | yes Sadly, <a href="https://checkmk.com/werk/17206"> Werk #17206</a> caused a severe regression and had to be reverted, see <a href="https://checkmk.com/werk/17133"> Werk #17133</a>. This Werk reintroduces the behaviour introduced by <a href="https://checkmk.com/werk/17206"> Werk #17206</a>, but without the hanging. Here is a recapitulation of what this Werk does: If a user runs `omd update`, then the output is written to both `$OMD_ROOT/var/log/update.log` and stdout. However, the output of site configuration verification <a href="https://checkmk.com/werk/16408"> Werk #16408</a> was missing. This has been fixed.

6 hours, 2 minutes

[2.4.0] Checkmk Werk 17191 created: mk_docker.py: Don't crash if a devices '/sys/block/DEVICE/dev' is missing

by Checkmk werks level 1

[//]: # (werk v2) # mk_docker.py: Don't crash if a devices '/sys/block/DEVICE/dev' is missing key | value ---------- | --- date | 2024-09-11T10:36:02+00:00 version | 2.4.0b1 class | fix edition | cre component | checks level | 1 compatible | yes

6 hours, 3 minutes

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level1 September 2024