LoginSign Up
← Back to all sparks
I

Icinga

INFRA · APIS
Velocity5.0

Open-source infrastructure and network monitoring system

icinga.com ↗

Icinga 2 has now shipped security releases in July, August and October.

monitoringsecurity fixesapi permissionsbackportsself-hosted
◆Current state
Icinga 2 patches security issues as simultaneous releases across its supported branches. On 28 October v2.16.6 and v2.15.7 fixed mail-flag injection in the default notification scripts plus several API issues. That follows the August pair closing a /v1/events permission bypass and a node-to-node memory exhaustion path, and the July trio covering 2.14, 2.15 and 2.16 with fixes for unauthenticated takeover and crash bugs.
◆Where it's heading
Three security rounds in four months point to a sustained audit of the API and cluster protocol, now reaching the shipped notification scripts. The 2.14 branch got the July fixes but no 2.14 release appears in the feed for August or October, which suggests its support is narrowing.
◆Prediction
Further paired 2.16.x and 2.15.x security releases are likely while the audit continues; watch whether 2.14 gets the October fixes at all.

◆Recent moves

  1. 16d ago

    Icinga 2 v2.16.6: security fixes incl. notification injection

    Security fixes for the notification-script injection and several API issues, plus small features. Upgrade-worthy for any deployment using default mail scripts.

    View source ↗
  2. 16d ago

    Icinga 2 v2.15.7: notification script injection fix

    Security fixes backported to 2.15, including mail-flag injection in the default notification scripts that could lead to command execution. Patch for anyone still on the older branch.

    View source ↗
  3. 2mo ago

    v2.16.5: /v1/events permission bypass and memory exhaustion fixed

    Two vulnerabilities closed - an authenticated ApiUser with events/* could read objects through crafted filter expressions without objects/query/* permission, and a node could exhaust another node's memory via the 1 GB message limit, now capped at 16 MiB - plus a fix for an IcingaDB regression dating to v2.16.0. The permission bug is the same class the July filter-expression work was addressing.

    View source ↗
  4. 2mo ago

    v2.15.6: the 2.15-branch twin of the August security fixes

    The 2.15-branch release carrying the same two security fixes as v2.16.5, tagged within half a minute of it and without the IcingaDB regression fix. Icinga's standard practice of shipping a security fix simultaneously to every supported branch.

    View source ↗
  5. 4mo ago

    Fixes API auth regression and hanging endpoint connections

    A regression from v2.16.0 that broke API authentication for clients sending HTTP Basic Auth only after being asked, endpoint connections that could hang indefinitely and block further attempts until restart, and OpenSSL compatibility. Operationally the most disruptive of the recent bugs.

    View source ↗
  6. 4mo ago

    2.14 security release adds filter-expression permission

    Critical fixes including two allowing an unauthenticated attacker to take over or crash the process over the network, plus the new filter-expression permission restricting which API users may use DSL filters. Enforcement is opt-in until v2.17 because the change is incompatible.

    View source ↗