[2.4.0] Checkmk Werk 16234 created: Hide credentials in ps output for mk_oracle

[//]: # (werk v2) # Hide credentials in ps output for mk_oracle key | value ---------- | --- compatible | yes version | 2.4.0b1 date | 2024-02-20T18:39:35+00:00 level | 1 class | security component | checks edition | cre In the mk_oracle plugin <tt>sqlplus</tt> used to be called with the connection string as an argument. This connection string could contain credentials necessary to authenticate against the database. These arguments could be extracted by other users (e.g. with use of <tt>ps</tt>). This vulnerability was reported to us, we are not aware of any exploitations. <b>Affected Versions:</b> 2.2.0 2.1.0 2.0.0 (probably older versions as well) <b>Vulnerability Management:</b> We have rated the issue with a CVSS Score of 3.8 (Low) with the following CVSS vector: <tt>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</tt>. We assigned CVE-2024-1742 to this vulnerability. <b>Changes:</b> With this Werk the connection string is now piped via stdin to <tt>sqlplus</tt>.