CVE-2020-14004

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.

This update for icinga2 fixes the following issues:

• Info that since version 2.12.0 following security issue is fixed: prepare-dirs script allows for symlink attack in the icinga user context. boo#1172171 (CVE-2020-14004)

Update to 2.12.1:

• Bugfixes
  • Core
    • Fix crashes during config update #8348 #8345
    • Fix crash while removing a downtime #8228
    • Ensure the daemon doesn't get killed by logrotate #8170
    • Fix hangup during shutdown #8211
    • Fix a deadlock in Icinga DB #8168
    • Clean up zombie processes during reload #8376
    • Reduce check latency #8276
  • IDO
    • Prevent unnecessary IDO updates #8327 #8320
    • Commit IDO MySQL transactions earlier #8349
    • Make sure to insert IDO program status #8330
    • Improve IDO queue stats logging #8271 #8328 #8379
  • Misc
    • Ensure API connections are closed properly #8293
    • Prevent unnecessary notifications #8299
    • Don't skip null values of command arguments #8174
    • Fix Windows .exe version #8234
    • Reset Icinga check warning after successful config update #8189

Update to 2.12.0:

• Breaking changes
  • Deprecate Windows plugins in favor of our
  • PowerShell plugins #8071
  • Deprecate Livestatus #8051
  • Refuse acknowledging an already acknowledged checkable #7695
  • Config lexer: complain on EOF in heredocs, i.e. {{{abc<EOF> #7541
• Enhancements
  • Core
    • Implement new database backend: Icinga DB #7571
    • Re-send notifications previously suppressed by their time periods #7816
  • API
    • Host/Service: Add acknowledgement_last_change and next_update attributes #7881 #7534
    • Improve error message for POST queries #7681
    • /v1/actions/remove-comment: let users specify themselves #7646
    • /v1/actions/remove-downtime: let users specify themselves #7645
    • /v1/config/stages: Add 'activate' parameter #7535
  • CLI
    • Add pki verify command for better TLS certificate troubleshooting #7843
    • Add OpenSSL version to 'Build' section in --version #7833
    • Improve experience with 'Node Setup for Agents/Satellite' #7835
  • DSL
    • Add get_template() and get_templates() #7632
    • MacroProcessor::ResolveArguments(): skip null argument values #7567
    • Fix crash due to dependency apply rule with ignore_on_error and non-existing parent #7538
    • Introduce ternary operator (x ? y : z) #7442
    • LegacyTimePeriod: support specifying seconds #7439
    • Add support for Lambda Closures (() use(x) => x and () use(x) => { return x }) #7417
  • ITL
    • Add notemp parameter to oracle health #7748
    • Add extended checks options to snmp-interface command template #7602
    • Add file age check for Windows command definition #7540
  • Docs
    • Development: Update debugging instructions #7867
    • Add new API clients #7859
    • Clarify CRITICAL vs. UNKNOWN #7665
    • Explicitly explain how to disable freshness checks #7664
    • Update installation for RHEL/CentOS 8 and SLES 15 #7640
    • Add Powershell example to validate the certificate #7603
  • Misc
    • Don't send event::Heartbeat to unauthenticated peers #7747
    • OpenTsdbWriter: Add custom tag support #7357
• Bugfixes
  • Core
    • Fix JSON-RPC crashes #7532 #7737
    • Fix zone definitions in zones #7546
    • Fix deadlock during start on OpenBSD #7739
    • Consider PENDING not a problem #7685
    • Fix zombie processes after reload #7606
    • Don't wait for checks to finish during reload #7894
  • Cluster
    • Fix segfault during heartbeat timeout with clients not yet signed #7970
    • Make the config update process mutually exclusive (Prevents file system race conditions) #7936
    • Fix check_timeout not being forwarded to agent command endpoints #7861
    • Config sync: Use a more friendly message when configs are equal and don't need a reload #7811
    • Fix open connections…

These are all security issues fixed in the icinga2-2.13.1-1.3 package on the GA media of openSUSE Tumbleweed.

This update for icinga2 fixes the following issues:

• CVE-2020-14004: prepare-dirs script allows for symlink attack in the icinga user context. (bsc#1172171)
• CVE-2020-29663: ignoring CRL, where revoked certificates due for renewal will automatically be renewed. (bsc#281137)
• CVE-2021-37698: Missing TLS server certificate validation in ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer. (bsc#281137)