We fixed two security vulnerabilities related to the web interface. They were related to the cross-site request forgery attack and the clickjacking attack. Both are used to induce users to perform actions that they do not intend to perform by hiding the NetEye web interface under some eye-catching pages or with some malicious links sent for example by email.
More information on how the vulnerabilities work can be found here:
Furthermore, we fixed a bug related to the users SSO in the ITOA module. When the users belonged to teams of different organizations, the teams were not correctly assigned.
For NetEye 4.17 we updated the following packages:
httpd-neteye-config and httpd-neteye-config-autosetup to version 1.9.1-1
icingaweb2-module-analytics and icingaweb2-module-analytics-autosetup to version 1.38.1-1
Elastic Enterprise license renewal Previously, the Elastic Enterprise license was scheduled to expire on February 28, 2026.With this update, the Elastic Enterprise license has been renewed and will now expire on December 31, 2026. In the case the health-check light/01004_elastic_license_check.sh is preventing Read More
Important: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic An update for the elastic-stack packages (elasticsearch, kibana, filebeat, logstash and elastic-agent) is now available for NetEye 4. Security Fix for NetEye 4.45 Read More
Fix upgrade 4.45 migration error We solved an issue that affected the upgrade to NetEye 4.45. The issue occurred during the migration of the monitoring role permissions to Icinga DB, due to the order in which packages were updated. List Read More
Fix NetEye web UI exception We solved an issue that affected the NetEye web UI, when the SLM feature module is not installed, causing an exception to be thrown. List of updated packages To solve the issues mentioned above, the Read More
Fix for memory corruption in icinga2 We solved an issue that affected icinga2. If the cleanup of the http sessions in the execute-script endpoint ran during a request, the re-balance in the internal datastructure would corrupt the requests memory, resulting Read More
