Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Icinga ausnutzen, um seine Privilegien zu erhöhen und vertrauliche Informationen offenzulegen.
Product
Icinga ist ein Monitoring System.
Vulnerabilities 2
-
High 8.8
Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation fo…
-
High 8.8
Passwords used to access external services inadvertently exposed through API
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 featur…
Revision history
-
#4
Neue Updates von Gentoo aufgenommen
-
#3
Neue Updates von Debian aufgenommen
-
#2
Neue Updates von Debian aufgenommen
-
#1
Initiale Fassung
References
-
Github Icinga vom 2021-07-15
https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7
-
Github Icinga vom 2021-07-15
https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5
-
Debian Security Advisory DLA-2816 vom 2021-11-10
https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html
-
Debian Security Advisory DLA-3953 vom 2024-11-16
https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html
-
Gentoo Linux Security Advisory GLSA-202412-08 vom 2024-12-07
https://security.gentoo.org/glsa/202412-08