linuxfabrik-lib vulnerabilities

Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins allows reading files via a hidden --test argument that does not confine paths to the test directory. An attacker controlling the nagios or icinga account can disclose root-readable file contents, e.g., via the deb-updates plugin.

Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.

Vulnerability in linuxfabrik-lib before version 4.2.0. The db_sqlite.py module created SQLite databases at predictable paths in /tmp and followed attacker-created symbolic links. An attacker with a local monitoring account can create a symlink and trigger a sudo-authorized plugin, leading to arbitrary path overwrite, denial of service, or manipulation of an existing database. Fixed in version 4.2.0.

A vulnerability in linuxfabrik-lib before version 6.0.0 allows a redirecting server to intercept credential headers (other than Authorization and Cookie) during URL requests. The lib.url.fetch() function forwards headers on cross-origin redirects.