Today, we are announcing the availability of Icinga 2 v2.16.6 and v2.15.7, and Icinga Web v2.14.1 and v2.13.2. All four releases fix security issues. Icinga 2 v2.16.6 and v2.15.7 also bring small features and bug fixes, and Icinga Web v2.14.1 comes with bug fixes as well.
Icinga Web
Icinga Web v2.14.1 and v2.13.2 fix four vulnerabilities. We recommend that all users upgrade as soon as possible. Icinga Web v2.12 and earlier receive no fixes. If you still run one of these versions, upgrade to v2.13.2 or later.
Security Fixes
The most severe vulnerability affects the standalone chart endpoints. Without logging in, attackers could read files that the web server can access and overload the server with expensive requests. Instead of patching the endpoints, we removed them.
The other three vulnerabilities require an account:
- Users of LDAP or database backends whose login name contains a
*could receive the group memberships, and therefore the permissions, of other users. Usernames are now matched literally, and LDAP authentication rejects login names that contain*. - Users who can create navigation items could inject HTML into the sidebar of other users through the item’s name.
- Any logged-in user could remove the remembered devices of other users, which ends their “stay logged in” sessions.
The advisories have all the details:
- GHSA-mph2-hvq4-8423: Unauthenticated file read and denial of service through chart endpoints (high)
- GHSA-jff6-vjrf-q9gj: Wildcards in login names grant the group memberships of other users (high)
- GHSA-grpw-587v-93vw: Stored XSS through navigation item names in sidebar submenu headers (moderate)
- GHSA-fmf2-272p-p3r9: Missing ownership check lets users remove other users’ remembered devices (low)
Many thanks to Alessandro Mizzaro of Sonar, moreamazingnick, and archnexus707 for reporting these issues responsibly.
More Fixes in v2.14.1
Icinga Web v2.14.1 also fixes several bugs. Pages that need a configuration database now explain what is missing instead of showing a stack trace. PostgreSQL authentication works with pdo_pgsql alone. Links with schemes such as data: or mailto: work again, which also fixes downloads in Safari. Database migrations work with TLS client certificates. Administrators can now set a default theme mode for users without a personal preference.
Please note that the password policy setting moved to Configuration > Application > Security and now requires the config/security permission. Roles that manage password policies with config/general need to be updated.
Icinga Web v2.14.1 requires Icinga PHP Library v1.1.0, which we released alongside. Package installations pull it in automatically. Icinga Web v2.13.2 contains only the security fixes and has no new requirements.
Upgrading
Module developers should check the upgrading documentation. The chart endpoints svg/chart.php and png/chart.php and the classes Icinga\Chart\Inline\Inline and Icinga\Chart\Inline\PieChart are gone, and chart styles no longer evaluate LESS syntax.
The full list of changes is in the release notes for v2.14.1 and v2.13.2.
Icinga 2
The first security issue fixed is that if the default email notification scripts are used, an attacker that is able to set the email address of the recipient could use this to inject arbitrary command line flags to the mail binary. The impact depends on what flags are provided by the underlying implementation. In case of GNU mailutils, it was demonstrated that this can be used to execute arbitrary commands.
Multiple issues have been fixed that can allow an attacker with valid API credentials to crash the Icinga 2 process, learn information about config objects they aren’t supposed to access (if they have access to related objects), or retrieve sensitive information from the diagnostic_information response value. In order to address the latter issue, that information is now only provided to users with the newly added diagnostic-information permission. In some places where this previously was the only source of reliable error reporting for API actions, the regular error reporting has been improved.
Lastly, various instances of unsanitized logging were fixed, that previously allowed unauthenticated attackers to falsify information contained in Icinga 2 log files.
Security (v2.16.6 and v2.15.7)
- Prevent a command line argument injection in the default
mail-host-notification.shandmail-service-notification.shnotification scripts, that could cause commands passed in the recipient email address to be executed (GHSA-chm5-8fg3-g6fw) - Prevent a crash of the Icinga 2 daemon caused by bad comparators being passed to
Array#sort()(GHSA-33vf-h78f-99p3) - Prevent log injection in various instances (GHSA-hhxh-8qx6-pxc3)
- API: Require an explicit permission to receive
diagnostic_informationas it can reveal sensitive information (GHSA-vwj4-g6h6-65gj) - API: Prevent unauthorized reads of joined objects via filter expressions (GHSA-2hhr-ccxm-x85p)
- Bump OpenSSL shipped for Windows to v3.5.9 (v2.16.6: #11063, v2.15.7: #11062)
Features (v2.16.6 only)
- Icinga DB: Add more information to runtime update streams needed for upcoming version of Icinga Notifications (#11121)
- API: Allow setting the exact acknowledge time in the acknowledge-problem action (#11121)
- Allow building with
-DCMAKE_CXX_STANDARD=20so that Icinga 2 can be built if its dependencyabseil-cppwas built with C++20 (#11096)
Bug fixes (v2.16.6 only)
- Icinga DB: Don’t report volatile checks as being in a soft state (#11100)
- Tests: Relax tolerances in timer tests, making them more reliable (#11046)
Miscellaneous (v2.15.7 only)
- Fix high response latency with multiple API-requests targeting non-existent hosts or services (#11119)
- Small code and performance optimizations in
Logclass (#11120) - Allow building with
-DCMAKE_CXX_STANDARD=20(#11095)
Notes on upgrading
One security issue (GHSA-chm5-8fg3-g6fw) affects the mail-host-notification.sh and mail-service-notification.sh scripts shipped with Icinga 2 in /etc/icinga2/scripts. If any of these was modified locally, the fix might not be applied automatically. After upgrading, make sure to check if there are any files with an extension like .dpkg-dist or .rpmnew next to it. If so, you need to incorporate the changes from these files into your configuration manually.
A new permission called diagnostic-information was added which is now required in order to receive the diagnostic_information field in API responses when setting the verbose parameter (GHSA-vwj4-g6h6-65gj). It is recommended to grant this permission only to trusted users, keeping it more restricted similar to debug output in other software.
Note that an earlier version of the upgrading documentation mentioned a change to the version numbers of the Windows builds. There is no such change with this release. It was planned but reverted during the release process due to concerns about compatibility.
Acknowledgements
The command line argument injection in mail-host-notification.sh and mail-service-notification.sh (GHSA-chm5-8fg3-g6fw) was reported by @PfiatDe on GitHub.
The source code for the new versions can be found in the Icinga 2 Git repository. Updated binary packages are available on packages.icinga.com and the Icinga for Windows repository. Updated container images are available on Docker Hub.
