Icinga

v2.16.2 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 27d Monitoring & Metrics

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

cluster distributed-monitoring elasticsearch graphite graylog icinga

+8 more

influxdb prometheus monitoring notification opentsdb performance rest tls

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Updates https://github.com/Icinga/icinga2/security/advisories/GHSA-vj39-ww8j-vvx5, https://github.com/Icinga/icinga2/security/advisories/GHSA-wh38-wg57-5w7g, and https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm across a mixed release.

Full changelog

This release fixes some critical security vulnerabilities in Icinga 2. Users are advised to upgrade immediately, as two of them allow an unauthenticated attacker to take over or crash the Icinga 2 process over the network. The other security fixes only affect authenticated API users.

In addition, a new permission named filter-expression is introduced, which allows specifying if individual API users are allowed to use DSL filter expressions in API queries. This allows further restricting some API users that don't need this capability, for example, those only submitting individual check results. Due to the incompatibility of this change, enforcement of this permission is opt-in until v2.17; see the upgrading docs for details.

Verify that certificate update requests come from an authorized endpoint (GHSA-vj39-ww8j-vvx5)
Fix stack overflow due to deeply nested data structures (GHSA-wh38-wg57-5w7g)
Prevent arbitrary config injection on object creation via the API (GHSA-jgqj-x5j9-vgcm)
Fix that /v1/config/files could send uninitialized memory in case of file I/O errors (#10871)
Add filter-expression permission to make it possible to prevent API users from using DSL filter expressions
Windows: Update bundled OpenSSL to v3.5.7 (#10893)

Security Fixes

GHSA-vj39-ww8j-vvx5 — verify certificate update requests come from an authorized endpoint
GHSA-wh38-wg57-5w7g — fix stack overflow caused by deeply nested data structures
GHSA-jgqj-x5j9-vgcm — prevent arbitrary config injection on object creation via the API

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Icinga

Get notified when new releases ship.

About Icinga

The core of our monitoring platform with a powerful configuration language and REST API.

All releases →