Fedora 33: monitorix 2021-5f7da70bfe
Summary
Monitorix is a free, open source and lightweight system monitoring tool
designed to monitor as many services and system resources as possible. It has
been created to be used under production Linux/UNIX servers, but due to its
simplicity and small size may also be used on embedded devices as well.
Security fix for [CVE-2021-3325]. This new version fixes a security bug
introduced in the 3.13.0 version that lead the HTTP built-in server to bypass
the Basic Authentication when the option hosts_deny is not defined, which is the
default. Besides this fix, this version also updates the main configuration
file to add the option hosts_deny = all by default inside the auth subsection,
in an attempt to make the default behaviour more clear. All users using the
3.13.0 version are advised and encouraged to upgrade to this new version, which
resolves the security issue. ---- This new version introduces three new
modules: the long-awaited pgsql.pm capable of monitoring up to 9 databases of an
unlimited number of PostgreSQL servers, the redis.pm and tinyproxy.pm which are
both also capable of monitoring an unlimited number of Redis and Tinyproxy
servers respectively. This version also includes some interesting new features.
The new CSS theming support will allow people to create their own color themes.
The new support for the ss command in port.pm and nginx.pm modules. The ability
to map the device names and also to include a title name in disk.pm module. The
new stacked visualization of network stats available on a number of modules, and
more. Also with this new version, Monitorix is able to be executed as a regular
user instead of root. This is of course subject to the capabilities of each
module to get statistics without using the superuser. The rest of new features,
changes and bugs fixed are, as always, reflected in the Changes file.
* Wed Jan 27 2021 Jordi Sanfeliu
- Updated to 3.13.1.
* Fri Jan 22 2021 Jordi Sanfeliu
- Updated to 3.13.0.
[ 1 ] Bug #1920998 - monitorix-3.13.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1920998
[ 2 ] Bug #1921333 - CVE-2021-3325 monitorix: Basic Authentication bypass in a default installatio [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1921333
su -c 'dnf upgrade --advisory FEDORA-2021-5f7da70bfe' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/
FEDORA-2021-5f7da70bfe 2021-02-05 01:57:58.090629 Product : Fedora 33 Version : 3.13.1 Release : 1.fc33 URL : https://www.monitorix.org/ Summary : A free, open source, lightweight system monitoring tool Description : Monitorix is a free, open source and lightweight system monitoring tool designed to monitor as many services and system resources as possible. It has been created to be used under production Linux/UNIX servers, but due to its simplicity and small size may also be used on embedded devices as well. Security fix for [CVE-2021-3325]. This new version fixes a security bug introduced in the 3.13.0 version that lead the HTTP built-in server to bypass the Basic Authentication when the option hosts_deny is not defined, which is the default. Besides this fix, this version also updates the main configuration file to add the option hosts_deny = all by default inside the auth subsection, in an attempt to make the default behaviour more clear. All users using the 3.13.0 version are advised and encouraged to upgrade to this new version, which resolves the security issue. ---- This new version introduces three new modules: the long-awaited pgsql.pm capable of monitoring up to 9 databases of an unlimited number of PostgreSQL servers, the redis.pm and tinyproxy.pm which are both also capable of monitoring an unlimited number of Redis and Tinyproxy servers respectively. This version also includes some interesting new features. The new CSS theming support will allow people to create their own color themes. The new support for the ss command in port.pm and nginx.pm modules. The ability to map the device names and also to include a title name in disk.pm module. The new stacked visualization of network stats available on a number of modules, and more. Also with this new version, Monitorix is able to be executed as a regular user instead of root. This is of course subject to the capabilities of each module to get statistics without using the superuser. The rest of new features, changes and bugs fixed are, as always, reflected in the Changes file. * Wed Jan 27 2021 Jordi Sanfeliu - 3.13.1-1 - Updated to 3.13.1. * Fri Jan 22 2021 Jordi Sanfeliu - 3.13.0-1 - Updated to 3.13.0. [ 1 ] Bug #1920998 - monitorix-3.13.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1920998 [ 2 ] Bug #1921333 - CVE-2021-3325 monitorix: Basic Authentication bypass in a default installatio [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1921333 su -c 'dnf upgrade --advisory FEDORA-2021-5f7da70bfe' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/
Change Log
References
Update Instructions
