Checkmk werks level1

checkmk-werks-lvl1@lists.checkmk.com

1 participants
15969 discussions

Checkmk Werk 14291: NagVis: Updated to 1.9.34 (Fix security issues)

by Lars Michelsen

ID: 14291 Title: NagVis: Updated to 1.9.34 (Fix security issues) Component: Other Components Level: 1 Class: Security fix Version: 2.2.0i1 This update of NagVis fixes the following security issues: 1. Fix SSRF (triggerable by admin users) An administrative user with access to the global options, could perform a server-side request forgery. CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L (8.2) 2. Fix arbitrary file read An authenticated attacker can read arbitrary files with the permissions of the web server user. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L (9.1) 3. Fix type juggling vulnerability in cookie hash processing An attacker could bypass the authentication and gain access to the NagVis component of checkmk. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (3.7)

2 years, 1 month

Checkmk Werk 14742: Fix combined search for tag groups

by Ronny Bruska

ID: 14742 Title: Fix combined search for tag groups Component: Multisite Level: 1 Class: Bug fix Version: 2.2.0i1 If you used "tg:" for tag groups in combined searches, no results were shown, even if the search would match. This feature was broken since at least version 1.6. You can now use combined searches like "s: MY_SERVICE tg: MY_TAG" in the monitoring search and quicksearch again.

2 years, 1 month

Checkmk Werk 14718: SAP HANA bakery plugin: Handle user store key correctly

by Joerg Herbel

ID: 14718 Title: SAP HANA bakery plugin: Handle user store key correctly Component: agents Level: 1 Class: Bug fix Version: 2.2.0i1 The SAP HANA bakery plugin did not handle the option User store key under Credentials > Default credentials properly. Depending on the configured value, either the agent baking crashed or the baked agent plugin configuration was wrong, st. the plugin execution failed.

2 years, 1 month

Checkmk Werk 14383: Fix code injection in watolib

by Hannes Rantzsch

ID: 14383 Title: Fix code injection in watolib Component: Setup Level: 1 Class: Security fix Version: 2.2.0i1 This Werk fixes a code injection vulnerability in watolib. Prior to this Werk it was possible for authenticated users to inject PHP code in files generated by Wato for NagVis integration. The code would be executed once a request to the respective NagVis component is made. The underlying reason for this issue was that user data entered in Wato was not properly sanitized when writing to the PHP file. We thank Stefan Schiller (SonarSource) for reporting this issue. Affected Versions: All currently supported versions are affected: 1.6, 2.0, and 2.1. Mitigations: As an immediate mitigation you can entirely disable PHP on your server. Note that NagVis will not work anymore without PHP. Indicators of Compromise: Malicious code is injected in either of the files <tt>var/check_mk/wato/auth/auth.php</tt> or <tt>var/check_mk/wato/php-api/hosttags.php</tt>. Check these files for suspicious code. Vulnerability Management: We have rated the issue with a CVSS Score of 9.1 (Critical) with the following CVSS vector: <tt>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L</tt>. A CVE has been requested. Changes: This Werk fixes the vulnerability by improving sanitization.

2 years, 1 month

Checkmk Werk 14381: Fix command injection in SMS notification script

by Hannes Rantzsch

ID: 14381 Title: Fix command injection in SMS notification script Component: Notifications Level: 1 Class: Security fix Version: 2.2.0i1 Previous to this Werk it was possible to inject arbitrary shell commands when sending SMS notifications. For this, attackers would have needed to place a crafted string in a user's Pager Address, which was not properly escaped by the SMS script. In most setups, this issue will not be exploitable: Changing a user's Pager Address requires the User Management permission. Users with that permission are effectively Administrators and can thus already legitimately execute code in the Site context. Note however, that in some setups the attribute can also be configured by external interfaces, for example via LDAP User Synchronization. Affected Versions: All currently supported versions are affected: 1.6, 2.0, and 2.1. Mitigations: As an immediate mitigation all notifications via the method "SMS (using smstools)" can be disabled. Note that users' personal notification rules are affected as well. Indicators of Compromise: If you suspect this issue might have been exploited in your installation, validate users' Pager Address fields. Check the Audit Log for changes to this field. Vulnerability Management: We have rated the issue with a CVSS Score of 8.0 (High) with the following CVSS vector: <tt>CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H</tt>. A CVE has been requested. Changes: This Werk replaces a hazardous call to <tt>os.system</tt> by a safer alternative and adds additional validation to the Pager Address before attempting to send SMS to it. Valid Pager Addresses may now include letters, numbers, space characters, any of the characters <tt>. / - ()</tt>, as well as a <tt>+</tt> character at the beginning.

2 years, 1 month

Checkmk Werk 13955: Add graph data endpoint to the REST API

by Philipp Siegmantel

ID: 13955 Title: Add graph data endpoint to the REST API Component: REST API Level: 1 Class: New feature Version: 2.2.0i1 The REST API now has endpoints for querying graph data. They are analogous to the Web API endpoint. If you have any calls to ".../cmk/check_mk/webapi.py?action=get_graph...", please use the REST endpoint ("/domain-types/graph/actions/get_*_graph/invoke") instead. Please note that the request and response schemas differ from the Web API and any client code should be adjusted accordingly. Further details about the schemas can be found in the documentation of respective endpoints

2 years, 1 month

Checkmk Werk 14484: Add password strength meter

by Maximilian Wirtz

ID: 14484 Title: Add password strength meter Component: Setup Level: 1 Class: New feature Version: 2.2.0i1 When changing the password or creating a new user you now see a password strength meter indicating a estimation of the password strength.

2 years, 1 month

Checkmk Werk 14732: cmk-update-agent: Retry locking

by Andreas Umbreit

ID: 14732 Title: cmk-update-agent: Retry locking Component: agents Level: 1 Class: Bug fix Version: 2.2.0i1 The agent updater is designed to have no more than one instance running at a time on a host. This is implemented by holding a file lock while running. We recently observed that a lock may sometimes fail briefly after it was released by a previous agent updater instance, possibly due to some anti virus software. To mitigate this situation, the locking is now retried 10 times before aborting the agent updater call.

2 years, 1 month

Checkmk Werk 14762: mk_postgres.py: instances not found under Linux for PostgreSQL version >= 13

by Lisa Pichler

ID: 14762 Title: mk_postgres.py: instances not found under Linux for PostgreSQL version >= 13 Component: Checks & agents Level: 1 Class: Bug fix Version: 2.2.0i1 This fix only applies when your PostgreSQL server runs under Linux. The plugin "mk_postgres.py" does not find any instances when PostgreSQL version >= 13 is installed. This has been fixed. If you require this fix, please update the agent plugin "mk_postgres.py" on the relevant host. The problem was that in this version, the output of the "ps" command does not include the full path to the relevant binaries, and therefore they could not be correctly identified as PostgreSQL processes. For example: [PID] /usr/bin/postmaster [OPTS] --> [PID] postmaster [OPTS]

2 years, 1 month

Checkmk Werk 14771: Fix ping endpoint for InfluxDB

by Mathias Laurin

ID: 14771 Title: Fix ping endpoint for InfluxDB Component: Core & setup Level: 1 Class: Bug fix Version: 2.2.0i1 The InfluxDB connector checks whether a connection is possible over the "ping" endpoint. Before, the connector erroneously used the /api/v2/ping endpoint, which has stopped working in recent versions of the API. Now, it correctly uses the documented /ping endpoint.

2 years, 1 month

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

Checkmk werks level1