Alerts This Week
Warning Icon 1 637
Alerts This Week
Warning Icon 1 637

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 5 articles for you...
202

openSUSE Tumbleweed icinga2 Moderate CVE-2026-24413 Advisory

An update that solves one vulnerability can now be installed.. # icinga2-2.15.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10113-1 Rating: moderate Cross-References: * CVE-2026-24413 CVSS scores: * CVE-2026-24413 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2026-24413 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the icinga2-2.15.2-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * icinga2 2.15.2-1.1 * icinga2-bin 2.15.2-1.1 * icinga2-common 2.15.2-1.1 * icinga2-doc 2.15.2-1.1 * icinga2-ido-mysql 2.15.2-1.1 * icinga2-ido-pgsql 2.15.2-1.1 * nano-icinga2 2.15.2-1.1 * vim-icinga2 2.15.2-1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-24413.html . A new moderate security advisory for openSUSE Tumbleweed addresses CVE-2026-24413 in icinga2-2.15.2-1.1.. openSUSE icinga2 moderate advisory CVE-2026-24413. . LinuxSecurity.com Team

Calendar 2 Jan 31, 2026 OpenSUSE
202

openSUSE: icinga2 Important TLS Bypass CVE-2024-49369 Advisory 2025:0457-1

An update that solves one vulnerability and has one errata is now available.. openSUSE Security Update: Security update for icinga2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2025:0457-1 Rating: important References: #1084909 #1233310 Cross-References: CVE-2024-49369 CVSS scores: CVE-2024-49369 (SUSE): 10 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for icinga2 fixes the following issues: - Update to 2.14.5 * Bug Fixes - Don't close anonymous connections before sending the response for a certificate request #10337 - Performance data: Don't discard min/max values even if crit/warn thresholds aren\u2019t given #10339 - Fix a failing test case on systems time_t is only 32 bits #10343 * Documentation - Document the -X option for the mail-host-notification and mail-service-notification commands #10335 - Include Nagios in the migration docs #10324 - Remove RHEL 7 from installation instructions #10334 - Add instructions for installing build dependencies on Windows Server #10336 - Update to 2.14.4 * Crash Fixes - Invalid DateTime#format() arguments in config and console on Windows Server 2016 and older. #10112 - Downtime scheduling at runtime with non-existent trigger. #10049 - Object creation at runtime during Icinga DB initialization. #10151 - Comment on a service of a non-existent host. #9861 * Miscellaneous Bugfixes - Lost notifications after recovery outside the notification time period. #10187 - TimePeriod/ScheduledDowntime exceeding specified daterange. #9983 #10107 - Clean up failure for obsolete Downtimes. #10062 - ifw-api check command: use correct process-finished handler. #10140 - Email notification scripts: strip 0x0D (CR) for a proper Content-Type. #10061 - Several fixes and improvements of the code quality. #10066 #10214 #10254 #10263 #10264 * Cluster and API - Sync runtime objects in topological order to honor their dependencies. #10000 - Make parallel config syncs more robust. #10013 - After object creation via API fails, clean up properly for the next try. #10111 - Close HTTPS connections properly to prevent leaks. #10005 #10006 - Reduce the number of cluster messages in memory at the same time. #9991 #9999 #10210 - Once a cluster connection shall be closed, stop communicating. #10213 #10221 - Remove unnecessary blocking of semaphores. #9992 #9994 - Reduce unnecessary cluster messages setting the next check time. #10011 * Icinga DB and IDO - IDO: fix object relations after aborted synchronization. #10065 - Icinga DB, IDO: limit all timestamps to four year digits. #10058 #10059 - Icinga DB: limit execution_time and latency (milliseconds) to database schema. #10060 * Troubleshooting - Add /v1/debug/malloc_info which calls malloc_info(3) if available. #10015 - Add log messages about own network I/O. #9993 #10141 #10207 - Several fixes and improvements of log messages. #9997 #10021 #10209 * Windows - Update OpenSSL shipped on Windows to v3.0.15. #10170 - Update Boost shipped on Windows to v1.86. #10114 - Support CMake v3.29. #10037 - Don't require to build .msi as admin. #10137 - Build configuration scripts: allow custom $CMAKE_ARGS. #10312 * Documentation - Distributed Monitoring: add section "External CA/PKI". #9825 - Explain how to enable/disabledebug logging on the fly. #9981 - Update supported OS versions and repository configuration. #10064 #10090 #10120 #10135 #10136 #10205 - Several fixes and improvements. #9960 #10050 #10071 #10156 #10194 - Replace broken links. #10115 #10118 #10282 - Fix typographical and similarly trivial errors. #9953 #9967 #10056 #10116 #10152 #10153 #10204 - Update to 2.14.3 - Security: fix TLS certificate validation bypass. CVE-2024-49369 (boo#1233310) - Security: update OpenSSL shipped on Windows to v3.0.15. - Windows: sign MSI packages with a certificate the OS trusts by default. - Update to 2.14.2 - InfluxDB: truncate timestamps to whole seconds to save disk space. #9969 - HttpServerConnection: log request processing time as well. #9970 - Update Boost shipped on Windows to v1.84. #9970 - Update to 2.14.1 * Security - Automatically renew own root CA and distribute it to all nodes. #9933 - Update OpenSSL shipped on Windows to v3.0.12. #9946 - Disable TLS renegotiation (handshake on existing connection). #9946 * Bugfixes - Icinga DB feature: fix crash due to missing NULL pointer check. #9946 - Icinga DB feature: fix data written into Redis crashing the Go daemon. #9946 - GelfWriter: fix deadlock on stop/reload caused by busy queue. #9947 - Don't lose notifications due to too long output, truncate it. #9947 * Enhancements - Discard duplicate problem notifications due to state filtering. #9932 - Speed up API filters targeting specific hosts/services to O(1). #9944 - POST /v1/console/*: return HTTP 503 while Icinga is reloading. #9947 - Update Boost shipped on Windows to v1.83. #9946 - Documentation: several fixes and improvements. #9921 - Update to 2.14.0 * Breaking Changes - Remove CheckResultReader (which has been deprecated since v2.9). #9714 - Remove StatusDataWriter(which has been deprecated since v2.9). #9715 - ElasticsearchWriter: drop support for Elasticsearch < v7. #9812 - Consider a checkable unreachable once one Dependency fails. Previously all of them had to fail. (Consult the upgrading docs.) #8218 - API: reject config modifications during reload with HTTP status 503. #9445 - icinga2 daemon: to reduce config load time, write file needed by icinga2 object list only if --dump-objects is given. #9586 #9591 - Default email notification scripts: link to Icinga DB Web, not the monitoring module. (Consult the upgrading docs.) #9742 #9757 - API: for security reasons hide TicketSalt in /v1/variables. #7863 * Icinga 2 Config DSL - Disallow global variable modification after config commit start (i.e. inside object/apply T "x" { ... }) to reduce config load time. #9740 - Forbid Dependency cycles at config load time. #8389 - Allow only strings in the arrays Host#groups, Service#groups and User#groups. Needed for consistency, especially by the IDO. #9057 - Disallow empty object names. (They worked only partially anyway.) #9409 * Enhancements - Significantly reduce config load time of large setups. #8118 #9555 #9557 #9572 #9577 #9603 #9608 #9627 #9648 #9657 #9662 - Allow to connect dependencies via redundancy groups. Only parents within one group are assumed to provide redundancy for each other. #8218 - Built-in check command ifw-api, communicates directly with the Icinga for Windows REST API. (Doesn't spawn a PowerShell process for that.) #9062 - JournaldLogger which logs to systemd journal. #9000 - API: POST /v1/objects: allow to discard some previously modified attributes, i.e. to restore the config files' values. #9783 - ElasticsearchWriter: support Elasticsearch v8. #9812 - Support $env.ENV_VAR_NAME$ macros. #8302 - Speed up Icinga DB config dump. #9524 - Default mail notification scripts: also print $host.notes$ and $service.notes$. #9713 - Enable built-in OpenSSL DH parameters to allow DHE TLS ciphers. #9811 - Clean up global default TLS cipher list to improve security. #9809 - Influxdb(2)Writer: write more precise timestamps (nanoseconds). #9599 * Bugfixes - Icinga DB feature: normalize several Redis data not to crash the Go daemon. #9772 #9775 #9792 #9793 #9794 #9805 - Fix parsing of perfdata across multiple lines in plugin output. #8969 - icinga check: fix last reload failure time. #8429 #9827 - Resolve macros inside custom vars of IcingaApplication. #9779 - SELinux: allow Icinga and its plugins to write to syslog. #9688 - ElasticsearchWriter: fix data buffer flush race condition during stop. #9810 - Trigger flexible downtimes not in the past if checkable is already down. #9726 - Send downtime expiration notifications immediately, not after up to a minute. #9726 * Cluster - Don't hang in timed out connection attempt. #9711 #9725 - Fix lost acknowledgements after re-connect. #9718 - cluster-zone check: don't complain about not connected other local zone members if there aren't any. #8595 - Allow agent to update executions delegated to it via /v1/actions/execute-command. #8627 * API - Disallow breaking inter-object relationships by changing relationship attributes at runtime, e.g. Service#host_name. #9407 - Correct several HTTP response status codes. #7958 #9354 - Correct Boolean field types previously reported by /v1/types as Number. #9514 * CLI - icinga2 daemon: fix -DConfiguration.Concurrency= flag which now allows to override the number of threads. #9643 - icinga2 node wizard: avoid unnecessary chown(2) which may fail and abort the wizard. #8744 - Correct several log messages. #8895 #8965 #9663 * ITL - Add linux_netdev check command. #9045 + Command Argument Changes - disk: don't pass -m (disk_megabytes) by default. #9642 - disk: pass -X fuse.portal (disk_exclude_type) by default. #9459 - http: support multiple -k (http_header) as array. #8574 - icmp: double defaults for -w (icmp_wpl) and -c (icmp_cpl). #9041 - logfiles: pass --winwarncrit (logfiles_winwarncrit) without argument. #9056 - nwc_health: pass SNMPv3-only args only when using SNMPv3. #9095 - vmware-esx-dc-runtime-tools and vmware-esx-soap-vm-runtime-tools: - rename --open-vm-tools to --open_vm_tools_ok (vmware_openvmtools). #9611 - Update to 2.13.8 * Bugfixes - Icinga DB feature: normalize several Redis data not to crash the Go daemon. #9814 - Don't hang in timed out connection attempt. #9815 - Trigger flexible downtimes not in the past if checkable is already down. #9817 - ElasticsearchWriter: fix data buffer flush race condition during stop. #9818 - SELinux: allow Icinga and its plugins to write to syslog. #9819 - Fix lost acknowledgements after re-connect. #9820 - Fix parsing of perfdata across multiple lines in plugin output. #9821 - cluster-zone check: don't complain about not connected other local zone members if there aren't any. #9822 * Updates - Update Boost shipped on Windows to v1.82. #9816 - Update OpenSSL shipped on Windows to v3.0.9. #9816 - Update vendored https://github.com/nlohmann/json to v3.9.1. #9816 - Update vendored https://github.com/nemtrif/utfcpp to v3.2.3. #9816 - Update to 2.13.7 * Security - Windows: update bundled OpenSSL to v1.1.1t. #9672 * Bugfixes - SELinux: fix user and domain creation by explicitly setting the role. #9690 - Signal handlers: don't interrupt and break plugins spawning. #9682 - Icinga DB: take check\_period into account during overdue calculation. #9679 - Avoid corrupted files: use fsync(2)/FlushFileBuffers() everywhere. #9681 - Solaris: fix compile error. #9680 * Enhancements - Windows: update bundled Boost to v1.81. #9678 - Documentation: several fixes and improvements. #9671 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2025-457=1 Package List: - openSUSE Backports SLE-15-SP7 (aarch64 i586 x86_64): icinga2-2.14.5-bp157.3.3.1 icinga2-bin-2.14.5-bp157.3.3.1 icinga2-common-2.14.5-bp157.3.3.1 icinga2-doc-2.14.5-bp157.3.3.1 icinga2-ido-mysql-2.14.5-bp157.3.3.1 icinga2-ido-pgsql-2.14.5-bp157.3.3.1 nano-icinga2-2.14.5-bp157.3.3.1 vim-icinga2-2.14.5-bp157.3.3.1 References: https://www.suse.com/security/cve/CVE-2024-49369.html https://bugzilla.suse.com/1084909 https://bugzilla.suse.com/1233310 . Update resolves important issue with icinga2 related to TLS certificate validation bypass. Immediate action required.. icinga2 update, openSUSE security, TLS security fix, important security patch, icinga2 vulnerability. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Dec 04, 2025 Important OpenSUSE
100

SUSE: Icinga2 Important CVE-2025-48057 Impersonation Threat Advisory

* bsc#1243747 Cross-References: * CVE-2025-48057 . # Security update for icinga2 Announcement ID: SUSE-SU-2025:02783-1 Release Date: 2025-08-13T08:53:45Z Rating: important References: * bsc#1243747 Cross-References: * CVE-2025-48057 CVSS scores: * CVE-2025-48057 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L * CVE-2025-48057 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-48057 ( NVD ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * HPC Module 12 * SUSE Linux Enterprise High Performance Computing 12 SP2 * SUSE Linux Enterprise High Performance Computing 12 SP3 * SUSE Linux Enterprise High Performance Computing 12 SP4 * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP2 * SUSE Linux Enterprise Server 12 SP3 * SUSE Linux Enterprise Server 12 SP4 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP2 * SUSE Linux Enterprise Server for SAP Applications 12 SP3 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for icinga2 fixes the following issues: * CVE-2025-48057: A certificate incorrectly treated as valid can allow an attacker to impersonate a trusted node (bsc#1243747). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * HPC Module 12 zypper in -t patch SUSE-SLE-Module-HPC-12-2025-2783=1 ## Package List: * HPC Module 12 (aarch64 x86_64) * icinga2-libs-2.8.2-3.11.2 * icinga2-ido-mysql-debuginfo-2.8.2-3.11.2 * icinga2-common-2.8.2-3.11.2 * icinga2-bin-debuginfo-2.8.2-3.11.2 * icinga2-debugsource-2.8.2-3.11.2 * icinga2-libs-debuginfo-2.8.2-3.11.2 * icinga2-doc-2.8.2-3.11.2 * icinga2-bin-2.8.2-3.11.2 * icinga2-ido-pgsql-debuginfo-2.8.2-3.11.2 * icinga2-ido-pgsql-2.8.2-3.11.2 * vim-icinga2-2.8.2-3.11.2 * icinga2-2.8.2-3.11.2 * icinga2-ido-mysql-2.8.2-3.11.2 ## References: * https://www.suse.com/security/cve/CVE-2025-48057.html * https://bugzilla.suse.com/show_bug.cgi?id=1243747 . SUSE unveiled a crucial patch for icinga2 to mitigate CVE-2025-48058, reinforcing defenses against spoofing vulnerabilities.. Icinga2 Update,SUSE Important Patch,CVE-2025-48057,SUSE Security Fix,Impersonation Vulnerability. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Aug 13, 2025 Important SuSE
202

openSUSE: 2025:15180-1 moderate: icinga2 security update

An update that solves one vulnerability can now be installed.. # icinga2-2.14.6-1.1 on GA media Announcement ID: openSUSE-SU-2025:15180-1 Rating: moderate Cross-References: * CVE-2025-48057 CVSS scores: * CVE-2025-48057 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-48057 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the icinga2-2.14.6-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * icinga2 2.14.6-1.1 * icinga2-bin 2.14.6-1.1 * icinga2-common 2.14.6-1.1 * icinga2-doc 2.14.6-1.1 * icinga2-ido-mysql 2.14.6-1.1 * icinga2-ido-pgsql 2.14.6-1.1 * nano-icinga2 2.14.6-1.1 * vim-icinga2 2.14.6-1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-48057.html . A patch for icinga2-2.14.6-1.1 is now available on openSUSE, addressing a medium-level vulnerability. Implement this update to enhance your system's protection.. openSUSE update, icinga2 security, moderate advisory, system vulnerabilities. . LinuxSecurity.com Team

Calendar 2 May 31, 2025 OpenSUSE
202

openSUSE 15 SP5: Security Update 2024:0371-1 critical: icinga2 TLS bypass

An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for icinga2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0371-1 Rating: important References: #1233310 Cross-References: CVE-2024-49369 CVSS scores: CVE-2024-49369 (SUSE): 10 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icinga2 fixes the following issues: Update to 2.13.10: - CVE-2024-49369: Fix TLS certificate validation bypass (bsc#1233310). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-371=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le x86_64): icinga2-2.13.10-bp155.3.3.1 icinga2-bin-2.13.10-bp155.3.3.1 icinga2-common-2.13.10-bp155.3.3.1 icinga2-doc-2.13.10-bp155.3.3.1 icinga2-ido-mysql-2.13.10-bp155.3.3.1 icinga2-ido-pgsql-2.13.10-bp155.3.3.1 nano-icinga2-2.13.10-bp155.3.3.1 vim-icinga2-2.13.10-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2024-49369.html https://bugzilla.suse.com/1233310 . Critical openSUSE Security Patch for icinga2 addresses a TLS certificate validation bypass vulnerability.. icinga2 security update, openSUSE, TLS certificate fix, important security advisory. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Nov 21, 2024 Important OpenSUSE
202

openSUSE: 2024:0372-1 important: icinga2 TLS certificate validation bypass

An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for icinga2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0372-1 Rating: important References: #1233310 Cross-References: CVE-2024-49369 CVSS scores: CVE-2024-49369 (SUSE): 10 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icinga2 fixes the following issues: Update to 2.13.10: - CVE-2024-49369: Fix TLS certificate validation bypass (bsc#1233310). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-372=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le x86_64): icinga2-2.13.10-bp156.4.3.1 icinga2-bin-2.13.10-bp156.4.3.1 icinga2-common-2.13.10-bp156.4.3.1 icinga2-doc-2.13.10-bp156.4.3.1 icinga2-ido-mysql-2.13.10-bp156.4.3.1 icinga2-ido-pgsql-2.13.10-bp156.4.3.1 nano-icinga2-2.13.10-bp156.4.3.1 vim-icinga2-2.13.10-bp156.4.3.1 References: https://www.suse.com/security/cve/CVE-2024-49369.html https://bugzilla.suse.com/1233310 . This patch addresses a severe security flaw in icinga2. Please implement the update without delay.. openSUSE, icinga2, TLS, advisory, security update. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Nov 21, 2024 Important OpenSUSE
197

Debian 11: DLA-3953-1 critical: icinga2 privilege escalation and TLS flaws

Icinga 2 is a general-purpose monitoring application to fit the needs of any size of network. CVE-2021-32739 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3953-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Daniel Leidert November 16, 2024 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : icinga2 Version : 2.12.3-1+deb11u1 CVE ID : CVE-2021-32739 CVE-2021-32743 CVE-2021-37698 CVE-2024-49369 Debian Bug : 991494 1087384 Icinga 2 is a general-purpose monitoring application to fit the needs of any size of network. CVE-2021-32739 From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-only user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. CVE-2021-32743 In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for external services expose those credentials through the API to authenticated API users with read permissions for the corresponding object types. An attacker who obtains these credentials can impersonate Icinga to these services and add, modify and delete information there. CVE-2021-37698 In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite acertificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. CVE-2024-49369 The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). For Debian 11 bullseye, these problems have been fixed in version 2.12.3-1+deb11u1. We recommend that you upgrade your icinga2 packages. For the detailed security status of icinga2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/icinga2 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS Notification DLA-3954-2 highlights urgent vulnerabilities in icinga2; users are advised to perform updates to maintain security.. icinga2 security, Debian advisory, network monitoring, API vulnerabilities, TLS certificate issues. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Nov 15, 2024 Critical Debian LTS
197

Debian: DLA-2816-1 Critical: Icinga2 Multiple Threats Detected

Several vulnerabilities were discovered in Icinga 2, a general-purpose monitoring application. An attacker could retrieve sensitive information such as service passwords and ticket salt by querying the web API, or by intercepting unsufficiently checked encrypted . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2816-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Sylvain Beucler November 10, 2021 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : icinga2 Version : 2.6.0-2+deb9u2 CVE ID : CVE-2021-32739 CVE-2021-32743 CVE-2021-37698 Debian Bug : 991494 Several vulnerabilities were discovered in Icinga 2, a general-purpose monitoring application. An attacker could retrieve sensitive information such as service passwords and ticket salt by querying the web API, or by intercepting unsufficiently checked encrypted connections. CVE-2021-32739 A vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. See also complementary manual procedures: https://icinga.com/blog/releasing-icinga-2-12-5-and-2-11-10/ https://icinga.com/blog/releasing-icinga-2-12-5-and-2-11-10/ CVE-2021-32743 Some of the Icinga 2 features that require credentials for external services expose those credentials through the API to authenticated API users with read permissions for the corresponding objecttypes. IdoMysqlConnection and IdoPgsqlConnection exposes the password of the user used to connect to the database. An attacker who obtains these credentials can impersonate Icinga to these services and add, modify and delete information there. If credentials with more permissions are in use, this increases the impact accordingly. CVE-2021-37698 InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. For Debian 9 stretch, these problems have been fixed in version 2.6.0-2+deb9u2. We recommend that you upgrade your icinga2 packages. For the detailed security status of icinga2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/icinga2 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS Advisory DLA-2917-1 outlines vulnerabilities affecting Icinga 2 and provides guidance for implementing essential patches.. Debian Icinga2 Advisory, Security Update Icinga2, Icinga2 Security Issues. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Nov 10, 2021 Critical Debian LTS
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here