openSUSE-SU-2022:0087-1

Details

This update for icingaweb2 fixes the following issues:

icingaweb2 was updated to 2.8.6

This is a security release.

Security Fixes

CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users (GHSA-v9mv-h52f-7g63 boo#1196911)
CVE-2022-24714: Unwanted disclosure of hosts and related data, linked to decommissioned services (GHSA-qcmg-vr56-x9wf boo#1196913)

Affected Packages

icingacli

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2-common

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2-vendor-HTMLPurifier

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2-vendor-JShrink

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2-vendor-Parsedown

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2-vendor-dompdf

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2-vendor-lessphp

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

icingaweb2-vendor-zf1

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

php-Icinga

SUSE Package Hub 12

Fixed in:

2.8.6-15.1

References

REPORT

https://bugzilla.suse.com/1196911

REPORT

https://bugzilla.suse.com/1196913

ADVISORY

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GD5VHZVF4AMQ5DW6XK7XLRC3VYZWQGZW/

WEB

https://www.suse.com/security/cve/CVE-2022-24714

WEB

https://www.suse.com/security/cve/CVE-2022-24715