An update that fixes four vulnerabilities is now available.. openSUSE Security Update: Security update for icinga-php-library, icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2025:0473-1 Rating: moderate References: Cross-References: CVE-2025-27404 CVE-2025-27405 CVE-2025-27609 CVE-2025-30164 CVSS scores: CVE-2025-27404 (SUSE): 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for icinga-php-library, icingaweb2 fixes the following issues: Changes in icingaweb2: - Update to 2.12.6 - Search box shows many magnifying glasses for some community themes #5395 - Authentication hooks are not called with external backends #5415 - Improve Minimal layout #5386 - Update to 2.12.5 * PHP 8.4 Support We're again a little behind schedule, but now we support PHP 8.4! This means that installations on Ubuntu 25.04 and Fedora 42+ can now install Icinga Web without worrying about PHP related incompatibilities. Icinga packages will be available in the next few days. * Good Things Take Time There's only a single (notable) recent issue that is fixed with this release. All the others are a bit older. - External URLs set up as dashlets are not embedded the same as navigation items #5346 * But the team sat together a few weeks ago and fixed a bug here and there. And of course, also in Icinga Web! - Users who are not allowed to change the theme, cannot change the theme mode either #5385 - Improved compatibility with several SSO authentication providers #5000, #5227 - Filtering for older-than events with relative timedoes not work #5263 - Empty values are NULL in CSV exports #5350 * Breaking, Somewhat This is mainly for developers. With the support of PHP 8.4, we introduced a new environment variable, ICINGAWEB_ENVIRONMENT. Unless set to dev, Icinga Web will not show nor log deprecation notices anymore. - Update to 2.12.4 - Database login broken after upgrade #5343 - Update to 2.12.3 - XSS in embedded content CVE-2025-27405 - DOM-based XSS CVE-2025-27404 - Open redirect on login page CVE-2025-30164 - Reflected XSS CVE-2025-27609 - Login against Postgres DB is case-sensitive #5223 - Role list has no functioning quick search #5300 - After clicking on Check now, the page does not refresh itself #5293 - Service States display wrong since update to 2.12.2 #5290 - Set right version for icinga-php-library. - Fix usage of %requires_eq: invalid syntax previosly resulted in ignored lines and now properly returns an error. - Update to 2.12.2 - Sort by name of roles does not work properly #4789 - Settings menu flyout closes too fast / easy #5196 - CSP header is missing the script-src policy #5180 - Broken event overview due to IntlDateFormatter #5172 - Downtimes, which were started and canceled, are missing in the history #5176 - Usage of IcingaWeb2 api command returns 404, but is successful #5183 - Allow fontawesome icons as menu items #5205 - Error while opening a navigation root item #5177 - Dashlets twice in dashboard & not deletable #5203 - PluginOutputRenderer gets called twice #5271 - Graphs disappear after form controls are used #4996 - Make subgroups of custom variables fully collapsible #5256 - Provide group as required by RPM 4.19 - Update to 2.12.1 - Add PHP 8.3 support - Login Redirect Loop #5133 - UI database migration not fully compatible with PostgreSQL #5129 - Missing styles when logging out and in while CSP isenabled #5126 - Update to 2.12.0 - Support for PHP 8.2 #4918 - Support for Content-Security-Policy #4528 - Allow to initiate a refresh with __REFRESH__ #5108 - Don't refresh twice upon __CLOSE__ #5106 - Add event column-moved #5049 - Add copy-to-clipboard behavior #5041 - Access Oracle Database via tnsnames.ora / LDAP Naming Services #5062 - Reduce risk of crashing the x509 collector daemon #5115 - CSV export does not escape double quotes #4910 * Full changelog see: https://github.com/Icinga/icingaweb2/milestone/79?closed=1 - Massive changes in spec needed. - DB schema files are in schema not etc/schema in packaged tarball - Add subpackge php-fpm with php-fpm configuration. - Remove max php version restrictions for suse. - Fix rights for /etc/icingaweb2/enabledModules directory as upstream use. Changes in icinga-php-library: - Update to 1.17.0 - No changelog from upstream. - Update ot 0.14.1 - No changelog from upstream. - Remove unneded requires and buildrequires icinga-php-common. - Add missing requires. - Update to 0.13.0 - No changelog from upstream. - Update to 0.12.0 - No changelog from upstream. - Update to 0.11.0 - No changelog from upstream. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2025-473=1 Package List: - openSUSE Backports SLE-15-SP7 (noarch): icinga-php-library-0.17.0-bp157.2.3.1 icingacli-2.12.6-bp157.2.3.1 icingaweb2-2.12.6-bp157.2.3.1 icingaweb2-common-2.12.6-bp157.2.3.1 icingaweb2-php-fpm-2.12.6-bp157.2.3.1 php-icinga-2.12.6-bp157.2.3.1 References: https://www.suse.com/security/cve/CVE-2025-27404.html https://www.suse.com/security/cve/CVE-2025-27405.html https://www.suse.com/security/cve/CVE-2025-27609.html https://www.suse.com/security/cve/CVE-2025-30164.html . Identify and resolve security issues with icinga-php-library and icingaweb2 on openSUSE, rated moderate.. openSUSE security, icingaweb2 update, php library patch, security vulnerabilities. . LinuxSecurity.com Team
An update that fixes two vulnerabilities is now available. . openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0097-1 Rating: important References: #1196911 #1196913 Cross-References: CVE-2022-24714 CVE-2022-24715 CVSS scores: CVE-2022-24714 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-24715 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24715 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for icingaweb2 fixes the following issues: icingaweb2 was updated to 2.8.6 This is a security release. * Security Fixes - CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users (GHSA-v9mv-h52f-7g63 boo#1196911) - CVE-2022-24714: Unwanted disclosure of hosts and related data, linked to decommissioned services (GHSA-qcmg-vr56-x9wf boo#1196913) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-97=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): icingacli-2.8.6-bp153.2.3.1 icingaweb2-2.8.6-bp153.2.3.1 icingaweb2-common-2.8.6-bp153.2.3.1 icingaweb2-vendor-HTMLPurifier-2.8.6-bp153.2.3.1 icingaweb2-vendor-JShrink-2.8.6-bp153.2.3.1 icingaweb2-vendor-Parsedown-2.8.6-bp153.2.3.1 icingaweb2-vendor-dompdf-2.8.6-bp153.2.3.1 icingaweb2-vendor-lessphp-2.8.6-bp153.2.3.1 icingaweb2-vendor-zf1-2.8.6-bp153.2.3.1 php-Icinga-2.8.6-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-24714.html https://www.suse.com/security/cve/CVE-2022-24715.html https://bugzilla.suse.com/1196911 https://bugzilla.suse.com/1196913 . Critical patch released for icingaweb2 to mitigate significant vulnerabilities impacting openSUSE Backports SLE-15-SP3.. Icingaweb2 Update, openSUSE Security, Backports SLE-15-SP3, Security Fixes. . Severity: Important. LinuxSecurity.com Team
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1674-1 Rating: important References: #1175530 Cross-References: CVE-2020-24368 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for icingaweb2 fixes the following issues: - icingaweb2 was updated to 2.7.4 * CVE-2020-24368: Fixed a path Traversal which could have allowed an attacker to access arbitrary files which are readable by the process running (boo#1175530). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1674=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1674=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2020-1674=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-1674=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-1674=1 Package List: - openSUSE Leap 15.2 (noarch): icingacli-2.7.4-lp152.2.3.1 icingaweb2-2.7.4-lp152.2.3.1 icingaweb2-common-2.7.4-lp152.2.3.1 icingaweb2-vendor-HTMLPurifier-2.7.4-lp152.2.3.1 icingaweb2-vendor-JShrink-2.7.4-lp152.2.3.1 icingaweb2-vendor-Parsedown-2.7.4-lp152.2.3.1 icingaweb2-vendor-dompdf-2.7.4-lp152.2.3.1 icingaweb2-vendor-lessphp-2.7.4-lp152.2.3.1 icingaweb2-vendor-zf1-2.7.4-lp152.2.3.1 php-Icinga-2.7.4-lp152.2.3.1 - openSUSE Leap 15.1 (noarch): icingacli-2.7.4-lp151.6.8.1 icingaweb2-2.7.4-lp151.6.8.1 icingaweb2-common-2.7.4-lp151.6.8.1 icingaweb2-vendor-HTMLPurifier-2.7.4-lp151.6.8.1 icingaweb2-vendor-JShrink-2.7.4-lp151.6.8.1 icingaweb2-vendor-Parsedown-2.7.4-lp151.6.8.1 icingaweb2-vendor-dompdf-2.7.4-lp151.6.8.1 icingaweb2-vendor-lessphp-2.7.4-lp151.6.8.1 icingaweb2-vendor-zf1-2.7.4-lp151.6.8.1 php-Icinga-2.7.4-lp151.6.8.1 - openSUSE Backports SLE-15-SP2 (noarch): icingacli-2.7.4-bp152.2.3.1 icingaweb2-2.7.4-bp152.2.3.1 icingaweb2-common-2.7.4-bp152.2.3.1 icingaweb2-vendor-HTMLPurifier-2.7.4-bp152.2.3.1 icingaweb2-vendor-JShrink-2.7.4-bp152.2.3.1 icingaweb2-vendor-Parsedown-2.7.4-bp152.2.3.1 icingaweb2-vendor-dompdf-2.7.4-bp152.2.3.1 icingaweb2-vendor-lessphp-2.7.4-bp152.2.3.1 icingaweb2-vendor-zf1-2.7.4-bp152.2.3.1 php-Icinga-2.7.4-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): icingacli-2.7.4-bp151.5.6.1 icingaweb2-2.7.4-bp151.5.6.1 icingaweb2-common-2.7.4-bp151.5.6.1 icingaweb2-vendor-HTMLPurifier-2.7.4-bp151.5.6.1 icingaweb2-vendor-JShrink-2.7.4-bp151.5.6.1 icingaweb2-vendor-Parsedown-2.7.4-bp151.5.6.1 icingaweb2-vendor-dompdf-2.7.4-bp151.5.6.1 icingaweb2-vendor-lessphp-2.7.4-bp151.5.6.1 icingaweb2-vendor-zf1-2.7.4-bp151.5.6.1 php-Icinga-2.7.4-bp151.5.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingacli-2.7.4-12.1 icingaweb2-2.7.4-12.1 icingaweb2-common-2.7.4-12.1 icingaweb2-vendor-HTMLPurifier-2.7.4-12.1 icingaweb2-vendor-JShrink-2.7.4-12.1 icingaweb2-vendor-Parsedown-2.7.4-12.1 icingaweb2-vendor-dompdf-2.7.4-12.1 icingaweb2-vendor-lessphp-2.7.4-12.1 icingaweb2-vendor-zf1-2.7.4-12.1 php-Icinga-2.7.4-12.1 References: https://www.suse.com/security/cve/CVE-2020-24368.html https://bugzilla.suse.com/1175530 -- . A significant openSUSE notification regarding icingaweb2 highlights a severe path traversal vulnerability. Please verify that your systems are fully updated.. IcingaWeb2 Update, OpenSUSE Security, Path Traversal Issue, Icinga Security Fix. . Severity: Important. LinuxSecurity.com Team
A directory traversal vulnerability was discovered in Icinga Web 2, a web interface for Icinga, which could result in the disclosure of files readable by the process. . -------------------------------------------------------------------------Debian LTS Advisory DLA-2343-1
An update that solves 5 vulnerabilities and has one errata is now available.. openSUSE Security Update: Security update for icingaweb2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0067-1 Rating: moderate References: #1101357 #1119784 #1119785 #1119799 #1119800 #1119801 Cross-References: CVE-2018-18246 CVE-2018-18247 CVE-2018-18248 CVE-2018-18249 CVE-2018-18250 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for icingaweb2 to version 2.7.3 fixes the following issues: icingaweb2 update to 2.7.3: * Fixed an issue where servicegroups for roles with filtered objects were not available icingaweb2 update to 2.7.2: * Performance imrovements and bug fixes icingaweb2 update to 2.7.1: * Highlight links in the notes of an object * Fixed an issue where sort rules were no longer working * Fixed an issue where statistics were shown with an anarchist way * Fixed an issue where wildcards could no show results icingaweb2 update to 2.7.0: * New languages support * Now module developers got additional ways to customize Icinga Web 2 * UI enhancements icingaweb2 update to 2.6.3: * Fixed various issues with LDAP * Fixed issues with timezone * UI enhancements * Stability fixes icingaweb2 update to 2.6.2: You can find issues and features related to this release on our Roadmap. This bugfix release addresses the following topics: * Database connections to MySQL 8 no longer fail * LDAP connections now have a timeoutconfiguration which defaults to 5 seconds * User groups are now correctly loaded for externally authenticated users * Filters are respected for all links in the host and service group overviews * Fixed permission problems where host and service actions provided by modules were missing * Fixed an SQL error in the contact list view when filtering for host groups * Fixed time zone (DST) detection * Fixed the contact details view if restrictions are active * Doc parser and documentation fixes Fix security issues: - CVE-2018-18246: fixed an CSRF in moduledisable (boo#1119784) - CVE-2018-18247: fixed an XSS via /icingaweb2/navigation/add (boo#1119785) - CVE-2018-18248: fixed an XSS attack is possible via query strings or a dir parameter (boo#1119801) - CVE-2018-18249: fixed an injection of PHP ini-file directives involves environment variables as channel to send out information (boo#1119799) - CVE-2018-18250: fixed parameters that can break navigation dashlets (boo#1119800) - Remove setuid from new upstream spec file for following dirs: /etc/icingaweb2, /etc/icingaweb/modules, /etc/icingaweb2/modules/setup, /etc/icingaweb2/modules/translation, /var/log/icingaweb2 icingaweb2 updated to 2.6.1: - You can find issues and features related to this release on our [Roadmap](https://github.com/Icinga/icingaweb2/milestone/51?closed=1). - The command audit now logs a command's payload as JSON which fixes a [bug](https://github.com/Icinga/icingaweb2/issues/3535) that has been introduced in version 2.6.0. icingaweb2 was updated to 2.6.0: - You can find issues and features related to this release on our Roadmap. * Enabling you to do stuff you couldn't before - Support for PHP 7.2 added - Support for SQLite resources added - Login and Command (monitoring) auditing added with the help of a dedicated module - Pluginoutput rendering is now hookable by modules which allowsto render custom icons, emojis and .. cute kitties :octocat: * Avoiding that you miss something - It's now possible to toggle between list- and grid-mode for the host- and servicegroup overviews - The servicegrid now supports to flip its axes which allows it to be put into a landscape mode - Contacts only associated with services are visible now when restricted based on host filters - Negated and combined membership filters now work as expected (#2934) - A more prominent error message in case the monitoring backend goes down - The filter editor doesn't get cleared anymore upon hitting Enter * Making your life a bit easier - The tactical overview is now filterable and can be safely put into the dashboard - It is now possible to register new announcements over the REST Api - Filtering for custom variables now works in UTF8 environments * Ensuring you understand everything - The monitoring health is now beautiful to look at and properly behaves in narrow environments - Updated German localization - Updated Italian localization * Freeing you from unrealiable things - Removed support for PHP < 5.6 - Removed support for persistent database connections Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-67=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2020-67=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-67=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-67=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-67=1 Package List: - openSUSE Leap 15.1 (noarch): icingacli-2.7.3-lp151.6.5.1 icingaweb2-2.7.3-lp151.6.5.1 icingaweb2-common-2.7.3-lp151.6.5.1 icingaweb2-vendor-HTMLPurifier-2.7.3-lp151.6.5.1 icingaweb2-vendor-JShrink-2.7.3-lp151.6.5.1 icingaweb2-vendor-Parsedown-2.7.3-lp151.6.5.1 icingaweb2-vendor-dompdf-2.7.3-lp151.6.5.1 icingaweb2-vendor-lessphp-2.7.3-lp151.6.5.1 icingaweb2-vendor-zf1-2.7.3-lp151.6.5.1 php-Icinga-2.7.3-lp151.6.5.1 - openSUSE Leap 15.0 (noarch): icingacli-2.7.3-lp150.4.7.1 icingaweb2-2.7.3-lp150.4.7.1 icingaweb2-common-2.7.3-lp150.4.7.1 icingaweb2-vendor-HTMLPurifier-2.7.3-lp150.4.7.1 icingaweb2-vendor-JShrink-2.7.3-lp150.4.7.1 icingaweb2-vendor-Parsedown-2.7.3-lp150.4.7.1 icingaweb2-vendor-dompdf-2.7.3-lp150.4.7.1 icingaweb2-vendor-lessphp-2.7.3-lp150.4.7.1 icingaweb2-vendor-zf1-2.7.3-lp150.4.7.1 php-Icinga-2.7.3-lp150.4.7.1 - openSUSE Backports SLE-15-SP1 (noarch): icingacli-2.7.3-bp151.5.3.1 icingaweb2-2.7.3-bp151.5.3.1 icingaweb2-common-2.7.3-bp151.5.3.1 icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 php-Icinga-2.7.3-bp151.5.3.1 - openSUSE Backports SLE-15 (noarch): icingacli-2.7.3-bp150.2.7.1 icingaweb2-2.7.3-bp150.2.7.1 icingaweb2-common-2.7.3-bp150.2.7.1 icingaweb2-vendor-HTMLPurifier-2.7.3-bp150.2.7.1 icingaweb2-vendor-JShrink-2.7.3-bp150.2.7.1 icingaweb2-vendor-Parsedown-2.7.3-bp150.2.7.1 icingaweb2-vendor-dompdf-2.7.3-bp150.2.7.1 icingaweb2-vendor-lessphp-2.7.3-bp150.2.7.1 icingaweb2-vendor-zf1-2.7.3-bp150.2.7.1 php-Icinga-2.7.3-bp150.2.7.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): icingacli-2.7.3-9.1 icingaweb2-2.7.3-9.1 icingaweb2-common-2.7.3-9.1 icingaweb2-vendor-HTMLPurifier-2.7.3-9.1 icingaweb2-vendor-JShrink-2.7.3-9.1 icingaweb2-vendor-Parsedown-2.7.3-9.1 icingaweb2-vendor-dompdf-2.7.3-9.1 icingaweb2-vendor-lessphp-2.7.3-9.1 icingaweb2-vendor-zf1-2.7.3-9.1 php-Icinga-2.7.3-9.1 References: https://www.suse.com/security/cve/CVE-2018-18246.html https://www.suse.com/security/cve/CVE-2018-18247.html https://www.suse.com/security/cve/CVE-2018-18248.html https://www.suse.com/security/cve/CVE-2018-18249.html https://www.suse.com/security/cve/CVE-2018-18250.html https://bugzilla.suse.com/1101357 https://bugzilla.suse.com/1119784 https://bugzilla.suse.com/1119785 https://bugzilla.suse.com/1119799 https://bugzilla.suse.com/1119800 https://bugzilla.suse.com/1119801 -- . A recent update addresses various bugs and security vulnerabilities affecting icingaweb2 on openSUSE. Discover the solutions implemented and the procedures for updating your installation.. Icinga Web 2 Security Update, openSUSE Bug Fix, XSS CSRF Issues. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.