What's New in Version 2.6.4

Notice: This is a security release. It is recommended to immediately upgrade to this release.

Path Traversal Vulnerability

The vulnerability in question allows an attacker to access arbitrary files which are readable by the process running Icinga Web 2. Technical details can be found at the corresponding CVE-2020-24368 and in the issue below.

• Possible path traversal when serving static image files #4226

Upgrading from 2.6.x

RHEL/SLES:
yum install icingaweb2*2.6.4 icingacli-2.6.4 php-Icinga-2.6.4

Debian/Ubuntu:
apt-get upgrade icingaweb2=2.6.4-1.* icingaweb2-common=2.6.4-1.* php-icinga=2.6.4-1.*