Fedora 35: 2022-1a667b0f90 Moderate: Zabbix Permissions and XSS Fix

Zabbix is software that monitors numerous parameters of a network and the

health and integrity of servers. Zabbix uses a flexible notification mechanism

that allows users to configure e-mail based alerts for virtually any event.

This allows a fast reaction to server problems. Zabbix offers excellent

reporting and data visualization features based on the stored data.

This makes Zabbix ideal for capacity planning.

Zabbix supports both polling and trapping. All Zabbix reports and statistics,

as well as configuration parameters are accessed through a web-based front end.

A web-based front end ensures that the status of your network and the health of

your servers can be assessed from any location. Properly configured, Zabbix can

play an important role in monitoring IT infrastructure. This is equally true

for small organizations with a few servers and for large companies with a

multitude of servers.

Fix CVE-2022-23132, CVE-2022-23133, CVE-2022-23134

* Fri Jan 14 2022 Gwyn Ciesla - 1:5.0.19-1

- 5.0.19

- Fixed CVE-2022-23132, CVE-2022-23133, CVE-2022-23134.

[ 1 ] Bug #2040746 - CVE-2022-23134 zabbix: Possible view of the setup pages by unauthenticated users if config file already exists [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2040746

[ 2 ] Bug #2040755 - CVE-2022-23132 zabbix: Incorrect permissions of [/var/run/zabbix] forces dac_override [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2040755

[ 3 ] Bug #2040759 - CVE-2022-23133 zabbix: Stored XSS in host groups configuration window in Zabbix Frontend [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2040759

su -c 'dnf upgrade --advisory FEDORA-2022-1a667b0f90' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/

Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure