ID: 14686
Title: Added timeout to event console communication
Component: Livestatus
Level: 2
Class: Bug fix
Version: 2.2.0i1
An unresponsive event console could eat up Livestatus connections and even
cause a deadlock during the shutdown of the monitoring core. Now there is
timeout of 10s, after that you get a timeout error for the Livestatus
query or action.
ID: 14919
Title: Do not log host secret (2)
Component: agents
Level: 3
Class: Security fix
Version: 2.2.0i1
Unfortunately Werk #14916 was insufficient.
Therefore the vulnerability still exists.
This Werk fixes the problem.
When using the <i>Agent updater</i> the Checkmk server needs a secret in order to allow the agent to download new agents.
For security reasons this secret is unique for each host and generated with the <tt>cmk-update-agent register</tt> command.
Unfortunately the generated host secret was written to the cmk-update-agent.log.
This logfile is not protected and usually world-readable.
With this secret one can download the current agent from the Checkmk server.
Included in that agent package are the plugin configs which can contain other secrets. (e.g. database credentials)
Mitigations without updating:
LI: Reregister the agent-updater. Then sanitize the cmk-update-agent.log files.
LI: If you cannot rule out that any unauthorized user read <tt>/var/lib/check_mk_agent/cmk-update-agent.log</tt> respectively <tt>C:\ProgramData\checkmk\agent\log\cmk-update-agent.log</tt> you should rotate all secrets that might be or were included in the agent configurations.
Steps needed with the update:
LI: Update your agent.
LI: Reregister the agent-updater.
All versions including 1.5 are subject to this vulnerability.
We found this vulnerability internally and have no indication of any exploitation.
We calculated a CVSS 3.1 score of 6.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
ID: 14685
Title: Fixed real-time checks with encryption
Component: cmc
Level: 2
Class: Bug fix
Version: 2.2.0i1
Real-time check data which contains a 0-byte was not processed correctly, so
this mainly affected encrypted RTC data. This has been fixed.
Note that even normal check results were affected, but these are normally
text-only without any 0-bytes, so they worked basically all the time.
ID: 14871
Title: Windows agent's ProgramData directory is accessible only with admins permissions
Component: Checks & agents
Level: 2
Class: Security fix
Version: 2.2.0i1
Previous to this Werk every authenticated Windows user could read some sensitive data
from the Windows agent working directory. To prevent issues with leaking sensitive data
we restrict the permission to read data of the Windows agent.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
(https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/…)
ID: 14298
Title: Remove Web API
Component: Setup
Level: 2
Class: New feature
Version: 2.2.0i1
With Checkmk 2.1, announced by Werk #13640, the Web API was deprecated. This
release now removes the Web API.
We recommend migrating all existing scripts that use the Web API to the REST
API.
ID: 14872
Title: mk_logwatch plugins correctly reports changes on Windows
Component: Checks & agents
Level: 2
Class: Bug fix
Version: 2.2.0i1
Previously, mk_logwatch plugin may wrongly report as changed
the whole content of a log file. The source of the problem was
an unstable file identification algorithm on Windows.
With this release logwatch plugin on Windows always correctly
deteremines changed part of monitored file.
ID: 14916
Title: Do not log host secret
Component: agents
Level: 3
Class: Security fix
Version: 2.2.0i1
When using the <i>Agent updater</i> the Checkmk server needs a secret in order to allow the agent to download new agents.
For security reasons this secret is unique for each host and generated with the <tt>cmk-update-agent register</tt> command.
Unfortunately the generated host secret was written to the cmk-update-agent.log.
This logfile is not protected and usually world-readable.
With this secret one can download the current agent from the Checkmk server.
Included in that agent package are the plugin configs which can contain other secrets. (e.g. database credentials)
Mitigations without updateing:
LI: Reregister the agent-updater. Then sanitize the cmk-update-agent.log files.
LI: If you cannot rule out that any unauthorized user read <tt>/var/lib/check_mk_agent/cmk-update-agent.log</tt> respectively <tt>C:\ProgramData\checkmk\agent\log\cmk-update-agent.log</tt> you should rotate all secrets that might be or were included in the agent configurations.
Steps needed with the update:
LI: Update your agent.
LI: Reregister the agent-updater.
All versions including 1.5 are subject to this vulnerability.
We found this vulnerability internally and have no indication of any exploitation.
We calculated a CVSS 3.1 score of 6.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
ID: 14683
Title: Fixed livedump for Python 3
Component: Core & setup
Level: 2
Class: Bug fix
Version: 2.2.0i1
The livedump tool generated invalid configurations and states when used with
Python 3, effectively rendering the tool unusable. This has been fixed.
ID: 14534
Title: Add unit conversion support for graphs
Component: metrics
Level: 2
Class: New feature
Version: 2.2.0i1
This werk adds the support for converting the displayed unit of a metric
in a graph.
Currently we only support conversion of degrees from Celsius to
Fahrenheit or Kelvin but this can be extended in the future.
To convert a unit you can use the <i>Convert unit to<i> option in
<i>Graph Tunings<i>.