Checkmk werks level1

checkmk-werks-lvl1@lists.checkmk.com

1 participants
16154 discussions

[2.3.0] Checkmk Werk 16664 created: interface inventory: recombine default interface inventory row with cisco specific row

by Checkmk werks level 1

[//]: # (werk v2) # interface inventory: recombine default interface inventory row with cisco specific row key | value ---------- | --- date | 2024-03-22T11:52:27+00:00 version | 2.3.0b4 class | fix edition | cre component | inv level | 1 compatible | yes The inventory data of `inv_cisco_vlans` and `inv_if` used to be combined in one row. This behavior was broken as of 2.3, where two different rows were displayed for each inventory plugin. Now the rows are unified again. Also fixed the missing color of the status displayed in the inventory rows.

5 months, 2 weeks

[2.3.0] Checkmk Werk 16488 created: agent_aws: Crash in ReservationUtilization section

by Checkmk werks level 1

[//]: # (werk v2) # agent_aws: Crash in ReservationUtilization section key | value ---------- | --- date | 2024-03-22T07:17:07+00:00 version | 2.3.0b4 class | fix edition | cre component | checks level | 1 compatible | yes When no data was available for the ReservationUtilization section the special agent would crash. Now this error is handled and no longer crashes.

5 months, 2 weeks

[2.3.0] Checkmk Werk 16561 created: Fix GUI extensions with CEE specific files break CRE

by Checkmk werks level 1

[//]: # (werk v2) # Fix GUI extensions with CEE specific files break CRE key | value ---------- | --- date | 2024-03-22T07:01:27+00:00 version | 2.3.0b4 class | fix edition | cre component | multisite level | 1 compatible | yes In previous 2.3 beta releases the UI of the Raw edition could break in case extension packages were installed which contained files specific to the CEE, like e.g. agent bakery plugins. An exception like this was displayed in that case: ``` Traceback (most recent call last): File "/omd/sites/cre/bin/cmk-update-config", line 8, in <module> from cmk.update_config.main import ensure_site_is_stopped, main File "/omd/sites/cre/lib/python3/cmk/update_config/main.py", line 36, in <module> from cmk.gui import main_modules File "/omd/sites/cre/lib/python3/cmk/gui/main_modules.py", line 44, in <module> import cmk.gui.cee.registration # pylint: disable=no-name-in-module,cmk-module-layer-violation ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ModuleNotFoundError: No module named 'cmk.gui.cee.registration' ```

5 months, 2 weeks

[2.3.0] Checkmk Werk 16487 created: fortigate_signatures: Crash (Cannot render negative timespan)

by Checkmk werks level 1

[//]: # (werk v2) # fortigate_signatures: Crash (Cannot render negative timespan) key | value ---------- | --- date | 2024-03-19T14:31:54+00:00 version | 2.3.0b4 class | fix edition | cre component | checks level | 1 compatible | yes If the age reported by a Fortigate signature is in the future, the service would crash when rendering the age of the signature. If this is the case, the service will now display a hint to check your system time.

5 months, 2 weeks

[2.3.0] Checkmk Werk 16234 created: Hide credentials in ps output for mk_oracle

by Checkmk werks level 1

[//]: # (werk v2) # Hide credentials in ps output for mk_oracle key | value ---------- | --- compatible | yes version | 2.3.0b4 date | 2024-02-20T18:39:35+00:00 level | 1 class | security component | checks edition | cre In the mk_oracle plugin <tt>sqlplus</tt> used to be called with the connection string as an argument. This connection string could contain credentials necessary to authenticate against the database. These arguments could be extracted by other users (e.g. with use of <tt>ps</tt>). This vulnerability was reported to us, we are not aware of any exploitations. <b>Affected Versions:</b> 2.2.0 2.1.0 2.0.0 (probably older versions as well) <b>Vulnerability Management:</b> We have rated the issue with a CVSS Score of 3.8 (Low) with the following CVSS vector: <tt>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</tt>. We assigned CVE-2024-1742 to this vulnerability. <b>Changes:</b> With this Werk the connection string is now piped via stdin to <tt>sqlplus</tt>.

5 months, 2 weeks

[2.3.0] Checkmk Werk 16232 created: mk_oracle(ps1): Prevent privilege esclation to root

by Checkmk werks level 1

[//]: # (werk v2) # mk_oracle(ps1): Prevent privilege esclation to root key | value ---------- | --- compatible | yes version | 2.3.0b4 date | 2024-01-17T08:20:43+00:00 level | 3 class | security component | checks edition | cre The agent plugins mk_oracle, mk_oracle.ps1 and mk_oracle_crs were vulnerable to privilege escalation to root by the oracle user. A malicious oracle user could replace a binary (e.g. sqlplus) with another script and put it in the corresponding directory. The script would be executed by the root user. All binaries, which are called by the plugins, are now checked if they need to be executed as a non-root (non-administrator under Windows) user, preventing the privilege escalation. Affected binaries are: sqlplus, tnsping, crsctl. <h3>Affected Versions</h3> * 2.3.0 (beta) * 2.2.0 * 2.1.0 * 2.0.0 (EOL) and older <h3>Mitigations</h3> If updating is not possible, disable the mk_oracle plugin. <h3>Vulnerability Management</h3> We have rated the issue with a CVSS score of 8.2 (High) with the following CVSS vector: <code>CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H</code> We have assigned <code>CVE-2024-0638</code>. <h3>Changes</h3> All called binaries are now executed in a safe way.

5 months, 2 weeks

[2.3.0] Checkmk Werk 16198 created: mk_informix: Do not allow privilege escalation

by Checkmk werks level 1

[//]: # (werk v2) # mk_informix: Do not allow privilege escalation key | value ---------- | --- compatible | yes version | 2.3.0b4 date | 2024-03-08T14:57:50+00:00 level | 1 class | security component | checks edition | cre The informix database monitoring plugin would previously <code>eval</code> statements parsed from <code>$INFORMIXDIR/bin/onstat</code>. Since the plugin is usually run as root, this could cause statements injected in <code>$INFORMIXDIR/bin/onstat</code> to be run as root as well. By adding scripts named the same as other functionality found in <code>$PATH</code> to <code>$INFORMIXDIR/bin</code>, <code>$PATH</code> functionality could also be overshadowed and the custom executed as root. Finally, <code>$INFORMIXDIR/bin/onstat</code> would be executed as root, allowing a substituted script to be run with elevated privileges. With this werk, the environment variables will be exported instead and <code>$PATH</code> will now be searched before <code>$INFORMIXDIR/bin</code>. The plugin will now also check if <code>$INFORMIXDIR/bin/onstat</code> belongs to root if the plugin is executed as root. If not, it will be executed as the user owning the executable. This issue was found during internal review. <em>Affected Versions</em>: * 2.3.0 (beta) * 2.2.0 * 2.1.0 * 2.0.0 (EOL) <em>Vulnerability Management</em>: We have rated the issue with a CVSS Score of 8.8 (High) with the following CVSS vector: <code>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</code> and assigned CVE <code>CVE-2024-28824</code>.

5 months, 2 weeks

[2.3.0] Checkmk Werk 16626 created: trigger openapi-spec generation job during start, restart and reload

by Checkmk werks level 1

[//]: # (werk v2) # trigger openapi-spec generation job during start, restart and reload key | value ---------- | --- date | 2024-03-20T13:23:59+00:00 version | 2.3.0b4 class | feature edition | cre component | omd level | 1 compatible | yes Werk 16501 introduced a command to start a background job which triggers the regeneration of the API specification. This werk now includes execution of this command also during omd start, restart, and reload. With this mechanism the execution during `cmk-update-config` is no longer needed. Based on Werk 15724 the specification is now updated in these situations: * Create the initial spec after a site has been created * Update the spec after a site has been copied, restored or renamed * Update the spec when the apache process is started, restarted or reloaded

5 months, 2 weeks

[2.3.0] Checkmk Werk 16654 created: Read-only internal folder name when editing folders

by Checkmk werks level 1

[//]: # (werk v2) # Read-only internal folder name when editing folders key | value ---------- | --- date | 2024-03-20T08:45:21+00:00 version | 2.3.0b4 class | fix edition | cre component | wato level | 1 compatible | yes When disabling the "Hide internal folder names in Setup" setting, the internal name must be set by the user when creating folders. Previously, the field was still modifiable when editing the folder properties, however no changes to it were saved. This werk now marks the field as read only when editing the folder properties.

5 months, 2 weeks

[2.3.0] Checkmk Werk 16178 created: dns: Reintroduce macro replacement in 'Expected DNS answers' config

by Checkmk werks level 1

[//]: # (werk v2) # dns: Reintroduce macro replacement in 'Expected DNS answers' config key | value ---------- | --- date | 2024-03-20T08:49:31+00:00 version | 2.3.0b4 class | fix edition | cre component | checks level | 1 compatible | yes With version 2.3.0b1, the macros in the 'Expected DNS answers' field of 'Check DNS service' were no longer replaced. This change reintroduces macro replacement.

5 months, 2 weeks

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level1