An icinga2 security update has been released for openSUSE Leap 15.2.

openSUSE-SU-2021:1029-1: moderate: Security update for icinga2

openSUSE Security Update: Security update for icinga2
______________________________________________________________________________

Announcement ID: openSUSE-SU-2021:1029-1
Rating: moderate
References: #1180147
Cross-References: CVE-2020-29663
CVSS scores:
CVE-2020-29663 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE-2020-29663 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Products:
openSUSE Leap 15.2
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for icinga2 fixes the following issues:

icinga2 was updated to 2.12.4

* Bugfixes

- Fix a crash when notification objects are deleted using the API #8782
- Fix crashes that might occur during downtime scheduling if host or
downtime objects are deleted using the API #8785
- Fix an issue where notifications may incorrectly be skipped after a
downtime ends #8775
- Don't send reminder notification if the notification is still
suppressed by a time period #8808
- Fix an issue where attempting to create a duplicate object using the
API might result in the original object being deleted #8787
- IDO: prioritize program status updates #8809
- Improve exceptions handling, including a fix for an uncaught
exception on Windows #8777
- Retry file rename operations on Windows to avoid intermittent
locking issues #8771

- Update to 2.12.3

* Security

- Fix that revoked certificates due for renewal will automatically be
renewed ignoring the CRL (Advisory / CVE-2020-29663 - fixes
boo#1180147 )

* Bugfixes

- Improve config sync locking - resolves high load issues on Windows
#8511
- Fix runtime config updates being ignored for objects without zone
#8549
- Use proper buffer size for OpenSSL error messages #8542

* Enhancements

- On checkable recovery: re-check children that have a problem #8506

- Update to 2.12.2

* Bugfixes

- Fix a connection leak with misconfigured agents #8483
- Properly sync changes of config objects in global zones done via the
API #8474 #8470
- Prevent other clients from being disconnected when replaying the
cluster log takes very long #8496
- Avoid duplicate connections between endpoints #8465
- Ignore incoming config object updates for unknown zones #8461
- Check timestamps before removing files in config sync #8495

* Enhancements

- Include HTTP status codes in log #8467

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.2:

zypper in -t patch openSUSE-2021-1029=1


Package List:

- openSUSE Leap 15.2 (x86_64):

icinga2-2.12.4-lp152.3.6.1
icinga2-bin-2.12.4-lp152.3.6.1
icinga2-bin-debuginfo-2.12.4-lp152.3.6.1
icinga2-common-2.12.4-lp152.3.6.1
icinga2-debuginfo-2.12.4-lp152.3.6.1
icinga2-debugsource-2.12.4-lp152.3.6.1
icinga2-doc-2.12.4-lp152.3.6.1
icinga2-ido-mysql-2.12.4-lp152.3.6.1
icinga2-ido-mysql-debuginfo-2.12.4-lp152.3.6.1
icinga2-ido-pgsql-2.12.4-lp152.3.6.1
icinga2-ido-pgsql-debuginfo-2.12.4-lp152.3.6.1
nano-icinga2-2.12.4-lp152.3.6.1
vim-icinga2-2.12.4-lp152.3.6.1

References:

  https://www.suse.com/security/cve/CVE-2020-29663.html
  https://bugzilla.suse.com/1180147