Security update for icinga2 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:1069-1 Final 1 1 2021-07-20T22:06:19Z current 2021-07-20T22:06:19Z 2021-07-20T22:06:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for icinga2 This update for icinga2 fixes the following issues: Update to 2.12.4 * Bugfixes - Fix a crash when notification objects are deleted using the API #8782 - Fix crashes that might occur during downtime scheduling if host or downtime objects are deleted using the API #8785 - Fix an issue where notifications may incorrectly be skipped after a downtime ends #8775 - Don't send reminder notification if the notification is still suppressed by a time period #8808 - Fix an issue where attempting to create a duplicate object using the API might result in the original object being deleted #8787 - IDO: prioritize program status updates #8809 - Improve exceptions handling, including a fix for an uncaught exception on Windows #8777 - Retry file rename operations on Windows to avoid intermittent locking issues #8771 * Enhancements - Support Boost 1.74 (Ubuntu 21.04, Fedora 34) #8792 Update to 2.12.3 * Security - Fix that revoked certificates due for renewal will automatically be renewed ignoring the CRL (Advisory / CVE-2020-29663 - fixes boo#1180147 ) * Bugfixes - Improve config sync locking - resolves high load issues on Windows #8511 - Fix runtime config updates being ignored for objects without zone #8549 - Use proper buffer size for OpenSSL error messages #8542 * Enhancements - On checkable recovery: re-check children that have a problem #8506 Update to 2.12.2 * Bugfixes - Fix a connection leak with misconfigured agents #8483 - Properly sync changes of config objects in global zones done via the API #8474 #8470 - Prevent other clients from being disconnected when replaying the cluster log takes very long #8496 - Avoid duplicate connections between endpoints #8465 - Ignore incoming config object updates for unknown zones #8461 - Check timestamps before removing files in config sync #8495 * Enhancements - Include HTTP status codes in log #8467 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-1069 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7RXCOMXKKWZ7PYODPH5SO5SSBKRXIJWA/ E-Mail link for openSUSE-SU-2021:1069-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1180147 SUSE Bug 1180147 https://www.suse.com/security/cve/CVE-2020-29663/ SUSE CVE CVE-2020-29663 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 icinga2-2.12.4-bp153.2.3.1 icinga2-bin-2.12.4-bp153.2.3.1 icinga2-common-2.12.4-bp153.2.3.1 icinga2-doc-2.12.4-bp153.2.3.1 icinga2-ido-mysql-2.12.4-bp153.2.3.1 icinga2-ido-pgsql-2.12.4-bp153.2.3.1 nano-icinga2-2.12.4-bp153.2.3.1 vim-icinga2-2.12.4-bp153.2.3.1 icinga2-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 icinga2-bin-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 icinga2-common-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 icinga2-doc-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 icinga2-ido-mysql-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 icinga2-ido-pgsql-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 nano-icinga2-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 vim-icinga2-2.12.4-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 icinga2-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 icinga2-bin-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 icinga2-common-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 icinga2-doc-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 icinga2-ido-mysql-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 icinga2-ido-pgsql-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 nano-icinga2-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 vim-icinga2-2.12.4-bp153.2.3.1 as a component of openSUSE Leap 15.3 Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3. CVE-2020-29663 SUSE Package Hub 15 SP3:icinga2-2.12.4-bp153.2.3.1 SUSE Package Hub 15 SP3:icinga2-bin-2.12.4-bp153.2.3.1 SUSE Package Hub 15 SP3:icinga2-common-2.12.4-bp153.2.3.1 SUSE Package Hub 15 SP3:icinga2-doc-2.12.4-bp153.2.3.1 SUSE Package Hub 15 SP3:icinga2-ido-mysql-2.12.4-bp153.2.3.1 SUSE Package Hub 15 SP3:icinga2-ido-pgsql-2.12.4-bp153.2.3.1 SUSE Package Hub 15 SP3:nano-icinga2-2.12.4-bp153.2.3.1 SUSE Package Hub 15 SP3:vim-icinga2-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:icinga2-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:icinga2-bin-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:icinga2-common-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:icinga2-doc-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:icinga2-ido-mysql-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:icinga2-ido-pgsql-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:nano-icinga2-2.12.4-bp153.2.3.1 openSUSE Leap 15.3:vim-icinga2-2.12.4-bp153.2.3.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7RXCOMXKKWZ7PYODPH5SO5SSBKRXIJWA/ https://www.suse.com/security/cve/CVE-2020-29663.html CVE-2020-29663 https://bugzilla.suse.com/1180147 SUSE Bug 1180147