openSUSE-SU-2022:0036-1
openSUSE-SU-2022:0036-1 · Security update for zabbix
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
This update for zabbix fixes the following issues: - Updated to latest realease 4.0.37. Security issues fixed: - CVE-2022-23134: Fixed possible view of the setup pages by unauthenticated users if config file already exists (boo#1194681). - CVE-2021-27927: Fixed CSRF protection mechanism inside CControllerAuthenticationUpdate controller (boo#1183014). - CVE-2020-15803: Fixed stored XSS in the URL Widget (boo#1174253). Bugfixes: - boo#1181400: Added hardening to systemd service(s) - boo#1144018: Restructured for easier maintenance because FATE#324346
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system · applications
Produits et versions concernés
zabbix openSUSE:Leap 15.3
- Plages de versions concernées
- ECOSYSTEM: < 4.0.37-lp153.2.3.1
Mettez à jour vers 4.0.37-lp153.2.3.1
Sources originales
- https://lists.opensuse.org/archives/list/[email protected]/thread/EDFZEEJCPRPPDEWV6JULRJZVSQCMYOEY/
- https://bugzilla.suse.com/1144018
- https://bugzilla.suse.com/1174253
- https://bugzilla.suse.com/1181400
- https://bugzilla.suse.com/1183014
- https://bugzilla.suse.com/1194681
- https://www.suse.com/security/cve/CVE-2020-15803
- https://www.suse.com/security/cve/CVE-2021-27927
- https://www.suse.com/security/cve/CVE-2022-23134
- https://osv.dev/vulnerability/openSUSE-SU-2022:0036-1