openSUSE-SU-2022:0036-1
openSUSE-SU-2022:0036-1 · Security update for zabbix
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for zabbix fixes the following issues: - Updated to latest realease 4.0.37. Security issues fixed: - CVE-2022-23134: Fixed possible view of the setup pages by unauthenticated users if config file already exists (boo#1194681). - CVE-2021-27927: Fixed CSRF protection mechanism inside CControllerAuthenticationUpdate controller (boo#1183014). - CVE-2020-15803: Fixed stored XSS in the URL Widget (boo#1174253). Bugfixes: - boo#1181400: Added hardening to systemd service(s) - boo#1144018: Restructured for easier maintenance because FATE#324346
Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
zabbix openSUSE:Leap 15.3
- Affected ranges
- ECOSYSTEM: < 4.0.37-lp153.2.3.1
Update to 4.0.37-lp153.2.3.1
Original sources
- https://lists.opensuse.org/archives/list/[email protected]/thread/EDFZEEJCPRPPDEWV6JULRJZVSQCMYOEY/
- https://bugzilla.suse.com/1144018
- https://bugzilla.suse.com/1174253
- https://bugzilla.suse.com/1181400
- https://bugzilla.suse.com/1183014
- https://bugzilla.suse.com/1194681
- https://www.suse.com/security/cve/CVE-2020-15803
- https://www.suse.com/security/cve/CVE-2021-27927
- https://www.suse.com/security/cve/CVE-2022-23134
- https://osv.dev/vulnerability/openSUSE-SU-2022:0036-1