Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2016:2877-1

Опубликовано: 22 нояб. 2016
Источник: suse-cvrf

Описание

Security update for monit

This update for monit fixes the following issues:

  • CVE-2016-7067: A malicious attacker could have used a cross-site request forgery vulnerability to trick an authenticated user to perform monit actions.

Monit was updated to 5.20, containing all upstream improvements and bug fixes.

The following tracked packaging bugs were fixed:

  • disable sslv3 according to RFC7568 (boo#974763)
  • fixed pid file directory (boo#971647)

Список пакетов

openSUSE Leap 42.1
monit-5.20.0-13.1
monit-doc-5.20.0-13.1
openSUSE Leap 42.2
monit-5.20.0-13.1
monit-doc-5.20.0-13.1

Ссылки

Описание

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Затронутые продукты
openSUSE Leap 42.1:monit-5.20.0-13.1
openSUSE Leap 42.1:monit-doc-5.20.0-13.1
openSUSE Leap 42.2:monit-5.20.0-13.1
openSUSE Leap 42.2:monit-doc-5.20.0-13.1
Ссылки

Описание

Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service.

Затронутые продукты
openSUSE Leap 42.1:monit-5.20.0-13.1
openSUSE Leap 42.1:monit-doc-5.20.0-13.1
openSUSE Leap 42.2:monit-5.20.0-13.1
openSUSE Leap 42.2:monit-doc-5.20.0-13.1
Ссылки
Уязвимость openSUSE-SU-2016:2877-1