-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 08 Nov 2021 20:07:42 +0100 Source: icinga2 Binary: icinga2 icinga2-common icinga2-bin icinga2-doc icinga2-classicui icinga2-ido-mysql icinga2-ido-pgsql icinga2-dbg libicinga2 icinga2-studio vim-icinga2 Architecture: source Version: 2.6.0-2+deb9u2 Distribution: stretch-security Urgency: high Maintainer: Debian Nagios Maintainer Group <pkg-nagios-devel@lists.alioth.debian.org> Changed-By: Sylvain Beucler <beuc@debian.org> Description: icinga2 - host and network monitoring system icinga2-bin - host and network monitoring system - daemon icinga2-classicui - host and network monitoring system - classic UI icinga2-common - host and network monitoring system - common files icinga2-dbg - host and network monitoring system - debug symbols icinga2-doc - host and network monitoring system - documentation icinga2-ido-mysql - host and network monitoring system - MySQL support icinga2-ido-pgsql - host and network monitoring system - PostgreSQL support icinga2-studio - host and network monitoring system - studio API GUI libicinga2 - host and network monitoring system - internal libraries vim-icinga2 - syntax highlighting for Icinga 2 config files in VIM Changes: icinga2 (2.6.0-2+deb9u2) stretch-security; urgency=high . * Non-maintainer upload by the LTS Security Team. * CVE-2021-32739: a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. See also complementary manual procedures: https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10/#change-ticket-salt https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10/#replace-icinga-ca * CVE-2021-32743: some of the Icinga 2 features that require credentials for external services expose those credentials through the API to authenticated API users with read permissions for the corresponding object types. IdoMysqlConnection and IdoPgsqlConnection exposes the password of the user used to connect to the database. An attacker who obtains these credentials can impersonate Icinga to these services and add, modify and delete information there. If credentials with more permissions are in use, this increases the impact accordingly. * CVE-2021-37698: InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. Checksums-Sha1: 8d0708f8a12d465b948149a63f2eb2b32ce2e4fd 2955 icinga2_2.6.0-2+deb9u2.dsc 11a9c29221d865fd2b3de69f4103c2e190d68141 2353930 icinga2_2.6.0.orig.tar.gz c74031b7434d3878bf6ce8384c6d741107d6b6ed 35656 icinga2_2.6.0-2+deb9u2.debian.tar.xz 0ad640d7f199b4b91838bde24c59f668dcc5f8c4 13165 icinga2_2.6.0-2+deb9u2_all.buildinfo Checksums-Sha256: 5acdde8cab30c06e3237601e13a86fa7d3c146a0c3d8dd79239bbeaac3c32f63 2955 icinga2_2.6.0-2+deb9u2.dsc b04627d7508dda4bb7b75b74501586d34b5d3d8752291c56682ba1137af03270 2353930 icinga2_2.6.0.orig.tar.gz 4ddbf7fa3fcdf56cd9b907ae14d30c55d8209b9f79a409fcae8d25ef2d6771d4 35656 icinga2_2.6.0-2+deb9u2.debian.tar.xz 714fd060fd19601d25679f6ca61024dc46a43e4f30d20a31ae8c231adbe011ce 13165 icinga2_2.6.0-2+deb9u2_all.buildinfo Files: f4d7e03339f300a49a4444fa0ae08503 2955 admin extra icinga2_2.6.0-2+deb9u2.dsc be7a897088f910069972b0250181ed27 2353930 admin extra icinga2_2.6.0.orig.tar.gz 8c27d7ec4a33b5997e3c72fa8f7038a6 35656 admin extra icinga2_2.6.0-2+deb9u2.debian.tar.xz be2045ee4dd47f549f7aec54ff974508 13165 admin extra icinga2_2.6.0-2+deb9u2_all.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmGMM1cACgkQDTl9HeUl XjBBqxAAnYBVDyZLrq+y7vHgFpp65oBIFoiWUmELbrV5gnBFPsG9f09IA1Cd8HMl 01qtqnMWlXtm2MJBsCnYPppJimtONjHOBse4XlQ37/zf5hByGf/OXftLy60ngK8D nx8fF37SamX0Rc3W2KPYwRPd9ipEbbfdqAO3czNrPD0lVlGhzbyBrVEgFAiq5WJW O2Kwm6igO9Lon/r27bYye+L3mL7bscMygXrrrTQJ6w8Dn3lVBE2YIP6f6HmondyA HVIIX3oTfccuPRnHdeLHYeMfeSiyH5OdkW8n3tA8ZTTEdr003KC0aefjxTfTuEUn Okr2QUIKIZG2UQDvpZU8hOjETsE9oafVQbYUxYekCUvT3R7tPHyy1D0ju0kISqUE HittjN3LzXH4FYPcN98QAOuVBSMDVCU3CHuEZ0sJtfn4TwFWBRG46ut5PNmFeigk CIV7P7NnYaVxzbWeg+V6Gp3KIGhnn74i0Ew4t3EalddAR/3nNChv5tQs5i/zMHAn bMxiX1pW6co4RT86xAtlDURzyZ1TkFcTHA5dTanRnQQ0TtF2gRnObGQawWWIt7g+ qUfxhujY+zrB7vEvdR048C9KOwxKyCMOGtkKUewdnaqyfVY97Ba7Lj3Mp6nfhF28 10LNPm1MDhmDYFpgExNEVdw8uNqP4g1nz4eGarvgkKnSYWsvfE4= =bZev -----END PGP SIGNATURE-----
