Fedora has issued an advisory on January 30: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3EGOZ3JA6TL3YUZ3XWYQ47OYQAJTWOTL/ The issues appear to have been fixed in 4.4.3. Reference for the first CVE: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641
nagios-4.3.1-2.2.mga6 submitted in updates_testing, fixing CVE-2018-13441, CVE-2018-1345[78] and CVE-2018-18245. We're not affected CVE-2016-8641, which only concerns sysinit service script.
Assignee: guillomovitch => qa-bugs
Thanks Guillaume! Advisory: ======================== Updated nagios packages fix security vulnerabilities: A flaw was found in Nagios Core version 4.4.1 and earlier. The qh_help function is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket (CVE-2018-13441). A flaw was found in Nagios Core version 4.4.1 and earlier. The qh_echo function is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket (CVE-2018-13457). A flaw was found in Nagios Core version 4.4.1 and earlier. The qh_core function is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket (CVE-2018-13458). A cross-site scripting (XSS) vulnerability has been discovered in Nagios Core. This vulnerability allows attackers to place malicious JavaScript code into the web frontend through manipulation of plugin output. In order to do this the attacker needs to be able to manipulate the output returned by nagios checks, e.g. by replacing a plugin on one of the monitored endpoints. Execution of the payload then requires that an authenticated user creates an alert summary report which contains the corresponding output (CVE-2018-18245). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13441 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13457 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13458 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18245 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3EGOZ3JA6TL3YUZ3XWYQ47OYQAJTWOTL/ ======================== Updated packages in core/updates_testing: ======================== nagios-4.3.1-2.2.mga6 nagios-www-4.3.1-2.2.mga6 nagios-devel-4.3.1-2.2.mga6 from nagios-4.3.1-2.2.mga6.src.rpm
CC: (none) => guillomovitchSummary: nagios new security issues CVE-2016-8641, CVE-2018-13441, CVE-2018-1345[78], CVE-2018-18245 => nagios new security issues CVE-2018-13441, CVE-2018-1345[78], CVE-2018-18245
MGA6-32 MATE on IBM Thinkpad R50e No installation issues Followed procedure in Wiki At CLI: # systemctl -l status httpd ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: enabled) Active: active (running) since do 2019-02-21 20:35:52 CET; 3min 8s ago Main PID: 19415 (httpd) Status: "Total requests: 0; Idle/Busy workers 100/0;Requests/sec: 0; Bytes served/sec: 0 B/sec" CGroup: /system.slice/httpd.service ├─19415 /usr/sbin/httpd -DFOREGROUND ├─19419 /usr/sbin/httpd -DFOREGROUND ├─19420 /usr/sbin/httpd -DFOREGROUND ├─19421 /usr/sbin/httpd -DFOREGROUND ├─19422 /usr/sbin/httpd -DFOREGROUND └─19423 /usr/sbin/httpd -DFOREGROUND feb 21 20:35:49 mach6.hviaene.thuis systemd[1]: Stopped The Apache HTTP Server. feb 21 20:35:49 mach6.hviaene.thuis systemd[1]: Starting The Apache HTTP Server... feb 21 20:35:52 mach6.hviaene.thuis systemd[1]: Started The Apache HTTP Server. # systemctl -l status nagios ● nagios.service - Nagios network monitor Loaded: loaded (/usr/lib/systemd/system/nagios.service; enabled; vendor preset: enabled) Active: inactive (dead) # systemctl -l start nagios # systemctl -l status nagios ● nagios.service - Nagios network monitor Loaded: loaded (/usr/lib/systemd/system/nagios.service; enabled; vendor preset: enabled) Active: active (running) since do 2019-02-21 20:39:30 CET; 2s ago Process: 19801 ExecStart=/usr/sbin/nagios -d /etc/nagios/nagios.cfg (code=exited, status=0/SUCCESS) Main PID: 19803 (nagios) CGroup: /system.slice/nagios.service ├─19803 /usr/sbin/nagios -d /etc/nagios/nagios.cfg ├─19805 /usr/sbin/nagios --worker /var/spool/nagios/nagios.qh ├─19806 /usr/sbin/nagios --worker /var/spool/nagios/nagios.qh ├─19807 /usr/sbin/nagios --worker /var/spool/nagios/nagios.qh ├─19808 /usr/sbin/nagios --worker /var/spool/nagios/nagios.qh └─19809 /usr/sbin/nagios -d /etc/nagios/nagios.cfg feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: nerd: Channel hostchecks registered successfully feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: nerd: Channel servicechecks registered successfully feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: nerd: Channel opathchecks registered successfully feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: nerd: Fully initialized and ready to rock! feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: wproc: Successfully registered manager as @wproc with feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: wproc: Registry request: name=Core Worker 19807;pid=19 feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: wproc: Registry request: name=Core Worker 19808;pid=19 feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: wproc: Registry request: name=Core Worker 19806;pid=19 feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: wproc: Registry request: name=Core Worker 19805;pid=19 feb 21 20:39:30 mach6.hviaene.thuis nagios[19803]: Successfully launched command file worker with pid 198 Checked info on different tabs and created (empty) graph on Trends section All looks OK
CC: (none) => herman.viaeneWhiteboard: (none) => MGA6-32-OK
Testing x86_64 for clean install only, as anything else is beyond my capability. Installed nagios 4.3.1-2.1, which pulled in several nagios-check packages, but by no means all of them. Also installed nagios-www. All packages installed cleanly. Used the package list from Comment 2 in the qarepo tool to update those packages. Again both packages installed cleanly. Giving this the 64-bit OK on the basis of that clean install. Validating on the basis of Herman's 32-bit tests. Suggested advisory in Comment 2.
Keywords: (none) => validated_updateWhiteboard: MGA6-32-OK => MGA6-32-OK MGA6-64-OKCC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => advisoryCC: (none) => davidwhodgins
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2019-0104.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED