An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2     systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged     user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be     changed to mode 2750 by the unprivileged icinga2 user. (CVE-2020-14004)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3725-1 advisory.

  - An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2     systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged     user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be     changed to mode 2750 by the unprivileged icinga2 user. (CVE-2020-14004)

  - Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will     automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3.
    (CVE-2020-29663)

  - Icinga is a monitoring system which checks the availability of network resources, notifies users of     outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0,     ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate     despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned     time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to     version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials     (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside     from upgrading. (CVE-2021-37698)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for icinga2 fixes the following issues :

  - Info that since version 2.12.0 following security issue     is fixed: prepare-dirs script allows for symlink attack     in the icinga user context. boo#1172171 (CVE-2020-14004)

Update to 2.12.1 :

  - Bugfixes

  + Core

  - Fix crashes during config update #8348 #8345

  - Fix crash while removing a downtime #8228

  - Ensure the daemon doesn't get killed by logrotate #8170

  - Fix hangup during shutdown #8211

  - Fix a deadlock in Icinga DB #8168

  - Clean up zombie processes during reload #8376

  - Reduce check latency #8276

  + IDO

  - Prevent unnecessary IDO updates #8327 #8320

  - Commit IDO MySQL transactions earlier #8349

  - Make sure to insert IDO program status #8330

  - Improve IDO queue stats logging #8271 #8328 #8379

  + Misc

  - Ensure API connections are closed properly #8293

  - Prevent unnecessary notifications #8299

  - Don't skip null values of command arguments #8174

  - Fix Windows .exe version #8234

  - Reset Icinga check warning after successful config     update #8189

Update to 2.12.0 :

  - Breaking changes

  - Deprecate Windows plugins in favor of our

  - PowerShell plugins #8071

  - Deprecate Livestatus #8051

  - Refuse acknowledging an already acknowledged checkable     #7695

  - Config lexer: complain on EOF in heredocs, i.e.
    (((abc<EOF> #7541

  - Enhancements

  + Core

  - Implement new database backend: Icinga DB #7571

  - Re-send notifications previously suppressed by their     time periods #7816

  + API

  - Host/Service: Add acknowledgement_last_change and     next_update attributes #7881 #7534

  - Improve error message for POST queries #7681

  - /v1/actions/remove-comment: let users specify themselves     #7646

  - /v1/actions/remove-downtime: let users specify     themselves #7645

  - /v1/config/stages: Add 'activate' parameter #7535

  + CLI

  - Add pki verify command for better TLS certificate     troubleshooting #7843

  - Add OpenSSL version to 'Build' section in --version     #7833

  - Improve experience with 'Node Setup for     Agents/Satellite' #7835

  + DSL

  - Add get_template() and get_templates() #7632

  - MacroProcessor::ResolveArguments(): skip null argument     values #7567

  - Fix crash due to dependency apply rule with     ignore_on_error and non-existing parent #7538

  - Introduce ternary operator (x ? y : z) #7442

  - LegacyTimePeriod: support specifying seconds #7439

  - Add support for Lambda Closures (() use(x) => x and ()     use(x) => ( return x )) #7417

  + ITL

  - Add notemp parameter to oracle health #7748

  - Add extended checks options to snmp-interface command     template #7602

  - Add file age check for Windows command definition #7540

  + Docs

  - Development: Update debugging instructions #7867

  - Add new API clients #7859

  - Clarify CRITICAL vs. UNKNOWN #7665

  - Explicitly explain how to disable freshness checks #7664

  - Update installation for RHEL/CentOS 8 and SLES 15 #7640

  - Add Powershell example to validate the certificate #7603

  + Misc

  - Don't send event::Heartbeat to unauthenticated peers     #7747

  - OpenTsdbWriter: Add custom tag support #7357

  - Bugfixes

  + Core

  - Fix JSON-RPC crashes #7532 #7737

  - Fix zone definitions in zones #7546

  - Fix deadlock during start on OpenBSD #7739

  - Consider PENDING not a problem #7685

  - Fix zombie processes after reload #7606

  - Don't wait for checks to finish during reload #7894

  + Cluster

  - Fix segfault during heartbeat timeout with clients not     yet signed #7970

  - Make the config update process mutually exclusive     (Prevents file system race conditions) #7936

  - Fix check_timeout not being forwarded to agent command     endpoints #7861

  - Config sync: Use a more friendly message when configs     are equal and don't need a reload #7811

  - Fix open connections when agent waits for CA approval     #7686

  - Consider a JsonRpcConnection alive on a single byte of     TLS payload, not only on a whole message #7836

  - Send JsonRpcConnection heartbeat every 20s instead of     10s #8102

  - Use JsonRpcConnection heartbeat only to update     connection liveness (m_Seen) #8142

  - Fix TLS context not being updated on signed certificate     messages on agents #7654

  + API

  - Close connections w/o successful TLS handshakes after     10s #7809

  - Handle permission exceptions soon enough, returning 404     #7528

  + SELinux

  - Fix safe-reload #7858

  - Allow direct SMTP notifications #7749

  + Windows

  - Terminate check processes with UNKNOWN state on timeout     #7788

  - Ensure that log replay files are properly renamed #7767

  + Metrics

  - Graphite/OpenTSDB: Ensure that reconnect failure is     detected #7765

  - Always send 0 as value for thresholds #7696

  + Scripts

  - Fix notification scripts to stay compatible with Dash     #7706

  - Fix bash line continuation in mail-host-notification.sh     #7701

  - Fix notification scripts string comparison #7647

  - Service and host mail-notifications: Add line-breaks to     very long output #6822

  - Set correct UTF-8 email subject header (RFC1342) #6369

  + Misc

  - DSL: Fix segfault due to passing null as custom function     to Array#(sort,map,reduce,filter,any,all)() #8053

  - CLI: pki save-cert: allow to specify --key and --cert     for backwards compatibility #7995

  - Catch exception when trusted cert is not readable during     node setup on agent/satellite #7838

  - CheckCommand ssl: Fix wrong parameter -N #7741

  - Code quality fixes

  - Small documentation fixes

  - Update to 2.11.5 Version 2.11.5 fixes file system race     conditions in the config update process occurring in     large HA environments and improves the cluster     connection liveness mechanisms.

  - Bugfixes

  + Make the config update process mutually exclusive     (Prevents file system race conditions) #8093

  + Consider a JsonRpcConnection alive on a single byte of     TLS payload, not only on a whole message #8094

  + Send JsonRpcConnection heartbeat every 20s instead of     10s #8103

  + Use JsonRpcConnection heartbeat only to update     connection liveness (m_Seen) #8097

  - Update to 2.11.4 Version 2.11.4 fixes a crash during a     heartbeat timeout with clients not yet signed. It also     resolves an issue with endpoints not reconnecting after     a reload/deploy, which caused a lot of UNKNOWN states.

  - Bugfixes

  + Cluster

  - Fix segfault during heartbeat timeout with clients not     yet signed #7997

  - Fix endpoints not reconnecting after reload (UNKNOWN     hosts/services after reload) #8043

  + Setup

  - Fix exception on trusted cert not readable during node     setup #8044

  - prepare-dirs: Only set permissions during directory     creation #8046

  + DSL

  - Fix segfault on missing compare function in Array     functions (sort, map, reduce, filter, any, all) #8054

  - Update to 2.11.3

  - Bugfixes

  - Cluster Fix JSON-RPC crashes (#7532) in large     environments: #7846 #7848 #7849

  - Set minimum require boost version to 1.66

  - Fix boo#1159869 Permission error when use the icinga cli     wizard. 

  - BuildRequire pkgconfig(libsystemd) instead of     systemd-devel: Aloow OBS to shortcut through the -mini     flavors.

  - Update to 2.11.2 This release fixes a problem where the     newly introduced config sync 'check-change-then-reload'     functionality could cause endless reload loops with     agents. The most visible parts are failing command     endpoint checks with 'not connected' UNKNOWN state. Only     applies to HA enabled zones with 2 masters and/or 2     satellites.

  - Bugfixes

  - Cluster Config Sync

  - Config sync checksum change detection may not work     within high load HA clusters #7565

  - Update to 2.11.1 This release fixes a hidden long     lasting bug unveiled with 2.11 and distributed setups.
    If you are affected by agents/satellites not accepting     configuration anymore, or not reloading, please upgrade.

  - Bugfixes

  - Cluster Config Sync

  - Never accept authoritative config markers from other     instances #7552

  - This affects setups where agent/satellites are newer     than the config master, e.g. satellite/agent=2.11.0,     master=2.10.

  - Configuration

  - Error message for command_endpoint should hint that zone     is not set #7514

  - Global variable 'ActiveStageOverride' has been set     implicitly via 'ActiveStageOverride ... #7521

  - Documentation

  - Docs: Add upgrading/troubleshooting details for repos,     config sync, agents #7526

  - Explain repository requirements for 2.11:
    https://icinga.com/docs/icinga2/latest/doc/16-upgrading-     icinga-2/#added-boost-166

  - command_endpoint objects require a zone:
    https://icinga.com/docs/icinga2/latest/doc/16-upgrading-     icinga-2/#agent-hosts-with-command-endpoint-require-a-zo     ne

  - Zones declared in zones.d are not loaded anymore:
    https://icinga.com/docs/icinga2/latest/doc/16-upgrading-     icinga-2/#config-sync-zones-in-zones

  - Update to 2.11.0

  - Core

  - Rewrite Network Stack (cluster, REST API) based on Boost     Asio, Beast, Coroutines

  - Technical concept: #7041

  - Requires package updates: Boost >1.66 (either from     packages.icinga.com, EPEL or backports). SLES11 & Ubuntu     14 are EOL.

  - Require TLS 1.2 and harden default cipher list

  - Improved Reload Handling (umbrella process, now 3     processes at runtime)

  - Support running Icinga 2 in (Docker) containers natively     in foreground

  - Quality: Use Modern JSON for C++ library instead of YAJL     (dead project)

  - Quality: Improve handling of invalid UTF8 strings

  - API

  - Fix crashes on Linux, Unix and Windows from Nessus scans     #7431

  - Locks and stalled waits are fixed with the core rewrite     in #7071

  - schedule-downtime action supports all_services for host     downtimes

  - Improve storage handling for runtime created objects in     the _api package

  - Cluster

  - HA aware features & improvements for failover handling     #2941 #7062

  - Improve cluster config sync with staging #6716

  - Fixed that same downtime/comment objects would be synced     again in a cluster loop #7198

  - Checks & Notifications

  - Ensure that notifications during a restart are sent

  - Immediately notify about a problem after leaving a     downtime and still NOT-OK

  - Improve reload handling and wait for features/metrics

  - Store notification command results and sync them in HA     enabled zones #6722

  - DSL/Configuration

  - Add getenv() function

  - Fix TimePeriod range support over midnight

  - concurrent_checks in the Checker feature has no effect,     use the global MaxConcurrentChecks constant instead

  - CLI

  - Permissions: node wizard/setup, feature, api setup now     run in the Icinga user context, not root

  - ca list shows pending CSRs by default, ca remove/restore     allow to delete signing requests

  - ITL

  - Add new commands and missing attributes

  - Windows

  - Update bundled NSClient++ to 0.5.2.39

  - Refine agent setup wizard & update requirements to .NET     4.6

  - Documentation

  - Service Monitoring: How to create plugins by example,     check commands and a modern version of the supported     plugin API with best practices

  - Features: Better structure on metrics, and supported     features

  - Technical Concepts: TLS Network IO, Cluster Feature HA,     Cluster Config Sync

  - Development: Rewritten for better debugging and     development experience for contributors including a     style guide. Add nightly build setup instructions.

  - Packaging: INSTALL.md was integrated into the     Development chapter, being available at     https://icinga.com/docs too.

  - Update to 2.10.6

  - Bugfixes

  - Fix el7 not loading ECDHE cipher suites #7247

  - update to 2.10.5

  - Core

  - Fix crashes with logrotate signals #6737 (thanks Elias     Ohm)

  - API

  - Fix crashes and problems with permission filters from     recent Namespace introduction #6785 (thanks Elias Ohm)     #6874 (backported from 2.11)

  - Reduce log spam with locked connections (real fix is the     network stack rewrite in 2.11) #6877

  - Cluster

  - Fix problems with replay log rotation and storage #6932     (thanks Peter Eckel)

  - IDO DB

  - Fix that reload shutdown deactivates hosts and     hostgroups (introduced in 2.9) #7157

  - Documentation

  - Improve the REST API chapter: Unix timestamp handling,     filters, unify POST requests with filters in the body

  - Better layout for the features chapter, specifically     metrics and events

  - Split object types into monitoring, runtime, features

  - Add technical concepts for cluster messages

ID	Name	Product	Family	Severity
258860	Linux Distros Unpatched Vulnerability : CVE-2020-14004	Nessus	Misc.	high
166535	SUSE SLES12 Security Update : icinga2 (SUSE-SU-2022:3725-1)	Nessus	SuSE Local Security Checks	critical
142522	openSUSE Security Update : icinga2 (openSUSE-2020-1820)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-14004

high

Tenable Plugins

high

critical

high