Disclaimer: The security issues referenced below do not yet have publicly disclosed CVE identifiers, so they are referenced by GHSA ID. This post will be updated as soon as CVEs become available.
Important: Icinga 2 security update
Type/Severity
NetEye Product Security has rated this update as having a Medium security impact.
Topic
An update for the icinga package is now available for NetEye 4.
Security Fix for NetEye 4.50
2.16.6_neteye1.77.3-1
Summary
- GHSA-chm5-8fg3-g6fw
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - GHSA-33vf-h78f-99p3
No CVSS score published - GHSA-hhxh-8qx6-pxc3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - GHSA-2hhr-ccxm-x85p
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - GHSA-vwj4-g6h6-65gj
No CVSS score published
The most severe issue affects the default e-mail notification scripts: an attacker able to control a notification recipient’s e-mail address can inject arbitrary command line flags into the mail binary. A second medium issue lets an attacker with API access crash Icinga 2 by passing a malformed comparator to Array#sort() via a crafted filter expression. Two further issues allow API users to read config objects they shouldn’t see through filter expressions, or to leak sensitive data (including stack-trace addresses usable for ASLR bypass) from diagnostic_information responses, which now require a newly added diagnostic-information permission. Finally, multiple log injection flaws allowed unauthenticated attackers to falsify Icinga 2 log entries.
Affected Products
All NetEye 4.x versions
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/Icinga/icinga2/releases/tag/v2.16.6
- https://github.com/Icinga/icinga2/security/advisories/GHSA-chm5-8fg3-g6fw
- https://github.com/Icinga/icinga2/security/advisories/GHSA-33vf-h78f-99p3
- https://github.com/Icinga/icinga2/security/advisories/GHSA-hhxh-8qx6-pxc3
- https://github.com/Icinga/icinga2/security/advisories/GHSA-2hhr-ccxm-x85p
- https://github.com/Icinga/icinga2/security/advisories/GHSA-vwj4-g6h6-65gj
Patrick Harasser
Author
