CVE-2020-14004

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script run as part of the icinga2 systemd service executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrar...

SUSE SLES12: icinga2 / icinga2-bin / icinga2-common / icinga2-doc / etc (SUSE-SU-2022:3725-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3725-1 advisory. - CVE-2020-14004: prepare-dirs script allows for symlink attack in the icinga user context. bsc1172171 - CVE-2020-29663: ignoring...

Security update for icinga2 (moderate)

openSUSE Security Update: Security update for icinga2 Announcement ID: openSUSE-SU-2020:1820-1 Rating: moderate References: 1159869 1172171 1174075 Cross-References: CVE-2020-14004 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1...

OPENSUSE-SU-2020:1820-1 Security update for icinga2

This update for icinga2 fixes the following issues: - Info that since version 2.12.0 following security issue is fixed: prepare-dirs script allows for symlink attack in the icinga user context. boo1172171 CVE-2020-14004 Update to 2.12.1: Bugfixes + Core - Fix crashes during config update 8348 834...

Icinga 2 < 2.12.0-rc1 Privilege Escalation Vulnerability

Icinga 2 is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:icinga:icinga2";...

CVE-2020-14004

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script run as part of the icinga2 systemd service executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrar...

CVE-2020-14004

CVE-2020-14004 affects Icinga2 prior to 2.12.0-rc1. The prepare-dirs script used by icinga2/systemd runs chmod 2750 on /run/icinga2/cmd, which is under an unprivileged user by default. If /run/icinga2/cmd is a symlink, an unprivileged icinga2 user can follow it and change arbitrary files to mode ...