DLA-3909-1

CVE-2022-24918 CVE-2022-24919 CVE-2022-35229 CVE-2022-35230 CVE-2022-43515 CVE-2023-29449 CVE-2023-29450 CVE-2023-29454 CVE-2023-29455 CVE-2023-29456 CVE-2023-29457 CVE-2023-29458 CVE-2023-32721 CVE-2023-32722 CVE-2023-32724 CVE-2023-32726 CVE-2023-32727 CVE-2024-22114 CVE-2024-22116 CVE-2024-22119 CVE-2024-22122 CVE-2024-22123 CVE-2024-36460 CVE-2024-36461 Debian Bug : 1014992 1014994 1026847 1053877 1055175 1078553

Several security vulnerabilities have been discovered in zabbix, a network monitoring solution, potentially among other effects allowing XSS, Code Execution, information disclosure, remote code execution, impersonation or session hijacking.

As the version uploaded is a new upstrea maintainance version, there a a few minor new features and behavioural changes with this version. Please see below for further information.

CVE-2022-23132

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is
in use to access PID files in [/var/run/zabbix] folder. In this case,
Zabbix Proxy or Server processes can bypass file read, write and execute
permissions check on the file system level

CVE-2022-23133

An authenticated user can create a hosts group from the configuration
with XSS payload, which will be available for other users. When XSS is
stored by an authenticated malicious actor and other users try to search
for groups during new host creation, the XSS payload will fire and the
actor can steal session cookies and perform session hijacking to
impersonate users or take over their accounts.

CVE-2022-24349

An authenticated user can create a hosts group from the configuration
with XSS payload, which will be available for other users. When XSS is
stored by an authenticated malicious actor and other users try to search
for groups during new host creation, the XSS payload will fire and the
actor can...