CVE-2020-14004
CVE-2020-14004
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.
CVSS 7.8 · High · EPSS 0.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
icinga2 Debian:12
- Affected ranges
- ECOSYSTEM: < 2.11.5-1
Update to 2.11.5-1
icinga2 Debian:13
- Affected ranges
- ECOSYSTEM: < 2.11.5-1
Update to 2.11.5-1
icinga2 Debian:14
- Affected ranges
- ECOSYSTEM: < 2.11.5-1
Update to 2.11.5-1
icinga2 Ubuntu:16.04:LTS
- Versions
- 2.3.8-1build1
- 2.3.11-1
- 2.4.0-1
- 2.4.1-1
- 2.4.1-2
- 2.4.1-2ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:18.04:LTS
- Versions
- 2.7.0-1
- 2.8.1-0ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:20.04:LTS
- Versions
- 2.10.5-1build1
- 2.11.2-1
- 2.11.2-1ubuntu1
- 2.11.2-1ubuntu2
- 2.11.2-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:22.04:LTS
- Versions
- 2.12.3-1
- 2.13.1-1
- 2.13.2-1
- 2.13.2-1build1
- 2.13.2-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:24.04:LTS
- Versions
- 2.13.8-1
- 2.14.1-1
- 2.14.2-1
- 2.14.2-1build1
- 2.14.2-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:25.10
- Versions
- 2.14.5-1
- 2.14.6-1
- 2.15.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:26.10
- Versions
- 2.15.1-1
- 2.16.1-1
- 2.16.3-1
- 2.16.4-1build1
- 2.16.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
icinga2 Ubuntu:26.04:LTS
- Versions
- 2.15.0-1
- 2.15.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-14004
- https://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6
- https://github.com/Icinga/icinga2/releases
- http://www.openwall.com/lists/oss-security/2020/06/12/1
- https://github.com/Icinga/icinga2/compare/v2.12.0-rc1...master
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-14004