Skip to content

Icinga 2 v2.15.7

Choose a tag to compare

View all tags
@julianbrost julianbrost released this 28 Oct 11:52
· 786 commits to master since this release
v2.15.7
This tag was signed with the committer’s verified signature.
julianbrost Julian Brost
GPG key ID: 7156E7BAE1774A00
Verified
Learn about vigilant mode.
5892b79

This release contains a number of different security fixes. In addition, some other small changes were backported to the 2.15 release branch in order to support them.

If the default email notification scripts are used, an attacker that is able to set the email address of the recipient could use this to inject arbitrary command line flags to the mail binary. The impact depends on what flags are provided by the underlying implementation. In case of GNU mailutils, it was demonstrated that this can be used to execute arbitrary commands.

Multiple issues have been fixed that can allow an attacker with valid API credentials to crash the Icinga 2 process, learn information about config objects they aren't supposed to access (if they have access to related objects), or retrieve sensitive information from the diagnostic_information response value. In order to address the latter issue, that information is now only provided to users with the newly added diagnostic-information permission. In some places where this previously was the only source of reliable error reporting for API actions, the regular error reporting has been improved.

Lastly, various instances of unsanitized logging were fixed, that previously allowed unauthenticated attackers to falsify information contained in Icinga 2 log files.

Security

  • Prevent a command line argument injection in the default mail-host-notification.sh and mail-service-notification.sh notification scripts, that could cause commands passed in the recipient email address to be executed (GHSA-chm5-8fg3-g6fw)
  • Prevent a crash of the Icinga 2 daemon caused by bad comparators being passed to Array#sort() (GHSA-33vf-h78f-99p3)
  • Prevent log injection in various instances (GHSA-hhxh-8qx6-pxc3)
  • API: Require an explicit permission to receive diagnostic_information as it can reveal sensitive information (GHSA-vwj4-g6h6-65gj)
  • API: Prevent unauthorized reads of joined objects via filter expressions (GHSA-2hhr-ccxm-x85p)
  • Bump OpenSSL shipped for Windows to v3.5.9 (#11062)

Miscellaneous

  • Fix high response latency with multiple API-requests targeting non-existent hosts or services (#11119)
  • Small code and performance optimizations in Log class (#11120)
  • Allow building with -DCMAKE_CXX_STANDARD=20 (#11095)
Assets 2
Loading