[SECURITY] [DSA 4747-1] icingaweb2 security update

2020-08-2320:47:16

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.0%

JSON

Debian Security Advisory DSA-4747-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
August 23, 2020 https://www.debian.org/security/faq

Package : icingaweb2
CVE ID : CVE-2020-24368
Debian Bug : 968833

A directory traversal vulnerability was discovered in Icinga Web 2, a
web interface for Icinga, which could result in the disclosure of files
readable by the process.

For the stable distribution (buster), this problem has been fixed in
version 2.6.2-3+deb10u1.

We recommend that you upgrade your icingaweb2 packages.

For the detailed security status of icingaweb2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/icingaweb2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian10allicingacli< 2.6.2-3+deb10u1icingacli_2.6.2-3+deb10u1_all.deb
Debian9allphp-icinga< 2.4.1-1+deb9u1php-icinga_2.4.1-1+deb9u1_all.deb
Debian9allicingaweb2< 2.4.1-1+deb9u1icingaweb2_2.4.1-1+deb9u1_all.deb
Debian10allphp-icinga< 2.6.2-3+deb10u1php-icinga_2.6.2-3+deb10u1_all.deb
Debian9allicingacli< 2.4.1-1+deb9u1icingacli_2.4.1-1+deb9u1_all.deb
Debian10allicingaweb2-module-doc< 2.6.2-3+deb10u1icingaweb2-module-doc_2.6.2-3+deb10u1_all.deb
Debian10allicingaweb2-module-monitoring< 2.6.2-3+deb10u1icingaweb2-module-monitoring_2.6.2-3+deb10u1_all.deb
Debian10allicingaweb2< 2.6.2-3+deb10u1icingaweb2_2.6.2-3+deb10u1_all.deb
Debian9allicingaweb2-common< 2.4.1-1+deb9u1icingaweb2-common_2.4.1-1+deb9u1_all.deb
Debian9allicingaweb2-module-doc< 2.4.1-1+deb9u1icingaweb2-module-doc_2.4.1-1+deb9u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	icingacli	< 2.6.2-3+deb10u1	icingacli_2.6.2-3+deb10u1_all.deb
Debian	9	all	php-icinga	< 2.4.1-1+deb9u1	php-icinga_2.4.1-1+deb9u1_all.deb
Debian	9	all	icingaweb2	< 2.4.1-1+deb9u1	icingaweb2_2.4.1-1+deb9u1_all.deb
Debian	10	all	php-icinga	< 2.6.2-3+deb10u1	php-icinga_2.6.2-3+deb10u1_all.deb
Debian	9	all	icingacli	< 2.4.1-1+deb9u1	icingacli_2.4.1-1+deb9u1_all.deb
Debian	10	all	icingaweb2-module-doc	< 2.6.2-3+deb10u1	icingaweb2-module-doc_2.6.2-3+deb10u1_all.deb
Debian	10	all	icingaweb2-module-monitoring	< 2.6.2-3+deb10u1	icingaweb2-module-monitoring_2.6.2-3+deb10u1_all.deb
Debian	10	all	icingaweb2	< 2.6.2-3+deb10u1	icingaweb2_2.6.2-3+deb10u1_all.deb
Debian	9	all	icingaweb2-common	< 2.4.1-1+deb9u1	icingaweb2-common_2.4.1-1+deb9u1_all.deb
Debian	9	all	icingaweb2-module-doc	< 2.4.1-1+deb9u1	icingaweb2-module-doc_2.4.1-1+deb9u1_all.deb