Today, we are announcing the availability of Icinga 2 v2.16.5 and v2.15.6. These releases contains some security enhancements that fix a couple of minor vulnerabilities. The release for v2.16.5 also contains a bugfix for a regression in the IcingaDB feature that was introduced in v2.16.0.
One vulnerability allowed an authenticated ApiUser with the events/* permission to obtain information about objects through crafted filter expressions, without holding the relevant objects/query/* permission. The fix is to correctly apply permissions to filter expressions on /v1/events.
The other vulnerability allowed an authenticated Icinga 2 node to use the ~1 GB message limit to possibly crash another node through memory exhaustion. Depending on available memory, multiple compromised nodes may be required for a successful attack since a node can only make one connection. The fix applies a 16 MiB limit to messages from nodes lower in the hierarchy.
Security Enhancements
- Apply user permissions to filter expressions for
/v1/eventssimilarly to/v1/objects(GHSA-v265-w3gm-99vg, CVE pending) - Introduce an additional 16 MiB message size limit on all child-zone connections (GHSA-wm63-p2jg-5665, CVE pending)
- Don’t include sensitive certificate request tickets in log messages (#10958)
- Don’t log full object config containing potentially sensitive information (#10982)
Bugfixes
- IcingaDB: Fix multiple potential race conditions during initial config dump (only in v2.16.5, #10957)
Releases
The source code for the new versions can be found in the Icinga 2 Git repository. Updated binary packages are available on packages.icinga.com and the Icinga for Windows repository. Updated container images are available on Docker Hub.
