This release contains a bugfix for a regression in the IcingaDB feature that was introduced in v2.16.0 and some security enhancements that fix a couple of minor vulnerabilities.
One vulnerability allowed an authenticated ApiUser with the events/* permission to obtain information about objects through crafted filter expressions, without holding the relevant objects/query/* permission. The fix is to correctly apply permissions to filter expressions on /v1/events.
The other vulnerability allowed an authenticated Icinga 2 node to use the ~1 GB message limit to possibly crash another node through memory exhaustion. Depending on available memory, multiple compromised nodes may be required for a successful attack since a node can only make one connection. The fix applies a 16 MiB limit to messages from nodes lower in the hierarchy.
Security Enhancements
- Apply user permissions to filter expressions for
/v1/eventssimilarly to/v1/objects(GHSA-v265-w3gm-99vg) - Introduce an additional 16 MiB message size limit on all child-zone connections (GHSA-wm63-p2jg-5665)
- Don't include sensitive certificate request tickets in log messages (#10960)
- Don't log full object config containing potentially sensitive information (#10988)
Bugfixes
- IcingaDB: Fix multiple potential race conditions during initial config dump (#10981)