738024 – (CVE-2020-24368) <www-apps/icingaweb2-{2.7.4,2.8.2}: Directory traversal vulnerability (CVE-2020-24368)

Bug 738024 (CVE-2020-24368) - <www-apps/icingaweb2-{2.7.4,2.8.2}: Directory traversal vulnerability (CVE-2020-24368)

Summary: <www-apps/icingaweb2-{2.7.4,2.8.2}: Directory traversal vulnerability (CVE-20...

Status:	RESOLVED FIXED

Alias:	CVE-2020-24368

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://github.com/Icinga/icingaweb2/...
Whiteboard:	B4 [glsa+ cve]
Keywords:

Depends on:
Blocks:

Reported:	2020-08-19 16:25 UTC by Sam James
Modified:	2022-08-04 14:15 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2020-08-19 16:25:29 UTC

Description:
"Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2."

Comment 1 Sam James archtester

2020-08-19 16:25:59 UTC

Please bump to 2.7.4 & 2.8.2.

Comment 2 John Helmert III archtester

2021-06-13 01:57:15 UTC

Please remember to use bug commit tags so security sees the bump happens! This has been done for some time now.

Comment 3 John Helmert III archtester

2022-08-04 04:28:46 UTC

GLSA request filed

Comment 4 Larry the Git Cow gentoo-dev

2022-08-04 14:02:12 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=911ba97fd465c36414fa2eb8a1fea31d4152990a

commit 911ba97fd465c36414fa2eb8a1fea31d4152990a
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-04 13:54:03 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-08-04 14:00:22 +0000

    [ GLSA 202208-05 ] Icinga Web 2: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/738024
    Bug: https://bugs.gentoo.org/834802
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202208-05.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

Comment 5 John Helmert III archtester

2022-08-04 14:15:48 UTC

GLSA released, all done!