Debian Package Tracker
Register | Log in
Subscribe

zabbix

Choose email to subscribe with

general
  • source: zabbix (main)
  • version: 1:6.0.14+dfsg-1
  • maintainer: Dmitry Smirnov (DMD)
  • uploaders: Christoph Haas [DMD]
  • arch: all any
  • std-ver: 4.6.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1:4.0.4+dfsg-1
  • o-o-sec: 1:4.0.4+dfsg-1+deb10u2
  • o-o-bpo: 1:5.0.8+dfsg-1~bpo10+1
  • oldstable: 1:5.0.8+dfsg-1
  • old-bpo: 1:6.0.14+dfsg-1~bpo11+1
  • stable: 1:6.0.14+dfsg-1
  • unstable: 1:6.0.14+dfsg-1
versioned links
  • 1:4.0.4+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:4.0.4+dfsg-1+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:5.0.8+dfsg-1~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:5.0.8+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:6.0.14+dfsg-1~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:6.0.14+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • zabbix-agent (3 bugs: 0, 2, 1, 0)
  • zabbix-agent2 (1 bugs: 0, 1, 0, 0)
  • zabbix-frontend-php (4 bugs: 0, 3, 1, 0)
  • zabbix-java-gateway
  • zabbix-proxy-mysql (1 bugs: 0, 0, 1, 0)
  • zabbix-proxy-pgsql
  • zabbix-proxy-sqlite3 (1 bugs: 1, 0, 0, 0)
  • zabbix-server-mysql (2 bugs: 0, 0, 2, 0)
  • zabbix-server-pgsql
  • zabbix-web-service (1 bugs: 0, 1, 0, 0)
action needed
A new upstream version is available: 6.0.22 high
A new upstream version 6.0.22 is available, you should consider packaging it.
Created: 2023-04-03 Last update: 2023-10-04 03:36
9 security issues in sid high

There are 9 open security issues in sid.

9 important issues:
  • CVE-2023-29449: JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
  • CVE-2023-29450: JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
  • CVE-2023-29451: Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
  • CVE-2023-29452: Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.
  • CVE-2023-29454: Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
  • CVE-2023-29455: Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29456: URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.
  • CVE-2023-29457: Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29458: Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
Created: 2023-07-14 Last update: 2023-10-01 20:32
9 security issues in trixie high

There are 9 open security issues in trixie.

9 important issues:
  • CVE-2023-29449: JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
  • CVE-2023-29450: JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
  • CVE-2023-29451: Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
  • CVE-2023-29452: Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.
  • CVE-2023-29454: Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
  • CVE-2023-29455: Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29456: URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.
  • CVE-2023-29457: Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29458: Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
Created: 2023-07-14 Last update: 2023-09-10 17:31
lintian reports 1 error and 23 warnings high
Lintian reports 1 error and 23 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2023-02-10 Last update: 2023-02-18 03:40
Depends on packages which need a new maintainer normal
The packages that zabbix depends on which need a new maintainer are:
  • dh-linktree (#980413)
    • Build-Depends: dh-linktree
Created: 2019-11-22 Last update: 2023-10-04 03:03
The package has not entered testing even though the delay is over normal
The package has not entered testing even though the 5-day delay is over. Check why.
Created: 2023-09-26 Last update: 2023-10-04 02:40
1 bug tagged patch in the BTS normal
The BTS contains patches fixing 1 bug, consider including or untagging them.
Created: 2023-09-13 Last update: 2023-10-04 02:37
17 low-priority security issues in bullseye low

There are 17 open security issues in bullseye.

16 issues left for the package maintainer to handle:
  • CVE-2022-23132: (needs triaging) During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
  • CVE-2022-23133: (needs triaging) An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.
  • CVE-2022-24349: (needs triaging) An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
  • CVE-2022-24917: (needs triaging) An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
  • CVE-2022-24918: (needs triaging) An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
  • CVE-2022-24919: (needs triaging) An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
  • CVE-2022-35229: (needs triaging) An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
  • CVE-2022-35230: (needs triaging) An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
  • CVE-2022-40626: (needs triaging) An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
  • CVE-2023-29449: (needs triaging) JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
  • CVE-2023-29450: (needs triaging) JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
  • CVE-2023-29454: (needs triaging) Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
  • CVE-2023-29455: (needs triaging) Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29456: (needs triaging) URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.
  • CVE-2023-29457: (needs triaging) Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29458: (needs triaging) Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

You can find information about how to handle these issues in the security team's documentation.

1 ignored issue:
  • CVE-2022-43515: Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being disclosed. An attacker can bypass this protection and access the instance using IP address not listed in the defined range.
Created: 2022-07-04 Last update: 2023-10-01 20:32
9 low-priority security issues in bookworm low

There are 9 open security issues in bookworm.

9 issues left for the package maintainer to handle:
  • CVE-2023-29449: (needs triaging) JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
  • CVE-2023-29450: (needs triaging) JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
  • CVE-2023-29451: (needs triaging) Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
  • CVE-2023-29452: (needs triaging) Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.
  • CVE-2023-29454: (needs triaging) Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
  • CVE-2023-29455: (needs triaging) Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29456: (needs triaging) URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.
  • CVE-2023-29457: (needs triaging) Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.
  • CVE-2023-29458: (needs triaging) Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-07-14 Last update: 2023-10-01 20:32
debian/patches: 1 patch to forward upstream low

Among the 12 debian patches available in version 1:6.0.14+dfsg-1 of the package, we noticed the following issues:

  • 1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2023-03-22 21:07
testing migrations
  • This package will soon be part of the auto-openldap transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
  • excuses:
    • Migration status for zabbix (- to 1:6.0.14+dfsg-1): BLOCKED: Rejected/violates migration policy/introduces a regression
    • Issues preventing migration:
    • ∙ ∙ Updating zabbix would introduce bugs in testing: #1050671, #1052897
    • Additional info:
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/z/zabbix.html
    • ∙ ∙ 196 days old (needed 5 days)
    • Not considered
news
[rss feed]
  • [2023-09-27] zabbix REMOVED from testing (Debian testing watch)
  • [2023-08-22] Accepted zabbix 1:4.0.4+dfsg-1+deb10u2 (source) into oldoldstable (Tobias Frost)
  • [2023-06-08] Accepted zabbix 1:6.0.14+dfsg-1~bpo11+1 (source) into bullseye-backports (Dmitry Smirnov)
  • [2023-05-07] zabbix 1:6.0.14+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2023-04-12] Accepted zabbix 1:4.0.4+dfsg-1+deb10u1 (source) into oldstable (Tobias Frost)
  • [2023-03-22] Accepted zabbix 1:6.0.14+dfsg-1 (source) into unstable (Dmitry Smirnov)
  • [2023-02-11] zabbix 1:6.0.13+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2023-02-06] Accepted zabbix 1:6.0.13+dfsg-1 (source) into unstable (Dmitry Smirnov)
  • [2022-11-27] zabbix 1:6.0.10+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2022-11-22] Accepted zabbix 1:6.0.10+dfsg-1 (source) into unstable (Dmitry Smirnov)
  • [2022-10-20] zabbix 1:6.0.9+dfsg-1.1 MIGRATED to testing (Debian testing watch)
  • [2022-10-15] Accepted zabbix 1:6.0.9+dfsg-1.1 (source) into unstable (Michael Biebl)
  • [2022-10-04] zabbix 1:6.0.9+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-29] Accepted zabbix 1:6.0.9+dfsg-1 (source) into unstable (Dmitry Smirnov)
  • [2022-09-12] zabbix 1:6.0.8+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-07] Accepted zabbix 1:6.0.8+dfsg-1 (source) into unstable (Dmitry Smirnov)
  • [2022-08-22] Accepted zabbix 1:6.0.7+dfsg-2~bpo11+1 (source amd64 all) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Dmitry Smirnov)
  • [2022-08-20] zabbix 1:6.0.7+dfsg-3 MIGRATED to testing (Debian testing watch)
  • [2022-08-15] Accepted zabbix 1:6.0.7+dfsg-3 (source) into unstable (Dmitry Smirnov)
  • [2022-08-07] zabbix 1:6.0.7+dfsg-2 MIGRATED to testing (Debian testing watch)
  • [2022-08-02] Accepted zabbix 1:6.0.7+dfsg-2 (source) into unstable (Dmitry Smirnov)
  • [2022-08-02] Accepted zabbix 1:6.0.7+dfsg-1 (source) into experimental (Dmitry Smirnov)
  • [2022-07-03] Accepted zabbix 1:6.0.6+dfsg-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Dmitry Smirnov)
  • [2022-04-12] Accepted zabbix 1:3.0.32+dfsg-0+deb9u3 (source) into oldoldstable (Markus Koschany)
  • [2022-04-06] Accepted zabbix 1:6.0.3+dfsg-1 (source) into experimental (Dmitry Smirnov)
  • [2022-02-07] Accepted zabbix 1:3.0.32+dfsg-0+deb9u2 (source) into oldoldstable (Sylvain Beucler)
  • [2021-12-03] Accepted zabbix 1:5.0.17+dfsg-1~bpo11+1 (source) into bullseye-backports (Dmitry Smirnov)
  • [2021-11-24] zabbix 1:5.0.17+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2021-11-19] Accepted zabbix 1:5.0.17+dfsg-1 (source) into unstable (Dmitry Smirnov)
  • [2021-09-09] Accepted zabbix 1:5.0.14+dfsg-1~bpo11+1 (source amd64 all) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Dmitry Smirnov)
  • 1
  • 2
bugs [bug history graph]
  • all: 17
  • RC: 3
  • I&N: 7
  • M&W: 7
  • F&P: 0
  • patch: 1
links
  • homepage
  • lintian (1, 23)
  • buildd: logs, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • l10n (-, 54)
  • debian patches
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1:6.0.14+dfsg-1
  • 71 bugs (1 patch)

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing