Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Every Linuxfabrik check plugin that supports the shared --test argument (routed through lib.lftest.test()) will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked through the shipped nagios/icinga sudoers allowlist. --test is a live production argument (centrally mapped to argparse.SUPPRESS, so it is hidden from --help but still accepted on the command line), not a build-time-only gate. This yields an arbitrary root file-read primitive (full disclosure on deb-updates; filtered disclosure / existence-and-readability oracle on ~22 other whitelisted plugins), i.e. local privilege escalation from the nagios account to root. Root Cause - lib.lftest.test(args) (lftest.py lines 659-664): stdout = args[0]; if stdout and os.path.isfile(stdout): , stdout = disk.readfile(stdout). Element[1] (stderr channel) is read the same way. There is no path confinement on…
Recommended action: Upgrade to 6.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
lib.url.fetch() follows HTTP redirects (followredirects=True). httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header (a session token such as Redfish's X-Auth-Token, an API key, ...) was still sent to the redirect target. A malicious or redirect-capable server can therefore answer an authenticated request with a 3xx to an attacker-chosen host and receive the credential (server-side request forgery + token disclosure). The pre-httpx urllib implementation was worse: it forwarded every header, including Authorization, across cross-host redirects. Impact Any plugin that authenticates to a host with a non-standard auth header and follows that host's redirects can be coerced into sending the credential, and an authenticated request, to another host the monitoring server can reach. The concrete case is the Redfish checks (X-Auth-Token), but the flaw is in the shared fetch() and affects every consumer. Patches…
Recommended action: Upgrade to 6.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When a check plugin places user provided input inside a command which is passed to shellexec, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get root privileges. Details An example for this is the restic-check plugin, where the --repo argument is placed inside the command argument of shellexec. As an example, an attacker could use the --repo argument |touch /root/nagios-was-here|. The full restic command is assembled to the string restic --json --repo=|touch /root/nagios-was-here| --password-file= check before it is passed to shellexec. shellexec then splits the command up in three parts at the | boundaries and executes the parts separately, which also executes the embedded command touch /root/nagios-was-here. PoC This PoC shows how the nagios user can use this to create a file inside /root. Impact The vulnerability is a local…
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SQLite databases are created at predictable (static) paths in /tmp. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target. This becomes really dangerous for the scripts which can be executed as root with sudo. With this, an attacker can write to abitrary paths. PoC The docker-stats check command here as an example. Because writing to /tmp is the default behaviour, the other check commands which use a SQLite database are also very likely affected. Check whether or not file was created. Impact In it's basic form, this vulnerbility can lead to a denial of service, impacting users who use the provided sudoers file and who didn't take any special precautions like systemd's PrivateTemp. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest). If any application on the server relies…
Recommended action: Upgrade to 4.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the Debian.sudoers file, apt-get is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user: PoC By choosing a particular argument, you can get (as a nagios user) a root shell: Since the nagious user can use sudo to run apt-get as root, the resulting shell is also running as root. Impact The vulnerability is a local privilege escalation, impacting users who use the provided sudoers file. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest). Fix Since only one place where apt-get is currently used (in deb-updates) was found, it should be enough to allow only the specific arguments used there. Here an example how the line in the sudoers file could look like:
Recommended action: Upgrade to 5.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.