[SECURITY] Fedora 35 Update: zabbix-5.0.19-1.fc35
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2022-1a667b0f90
2022-01-23 01:41:29.499893
--------------------------------------------------------------------------------
Name : zabbix
Product : Fedora 35
Version : 5.0.19
Release : 1.fc35
URL : https://www.zabbix.com
Summary : Open-source monitoring solution for your IT infrastructure
Description :
Zabbix is software that monitors numerous parameters of a network and the
health and integrity of servers. Zabbix uses a flexible notification mechanism
that allows users to configure e-mail based alerts for virtually any event.
This allows a fast reaction to server problems. Zabbix offers excellent
reporting and data visualization features based on the stored data.
This makes Zabbix ideal for capacity planning.
Zabbix supports both polling and trapping. All Zabbix reports and statistics,
as well as configuration parameters are accessed through a web-based front end.
A web-based front end ensures that the status of your network and the health of
your servers can be assessed from any location. Properly configured, Zabbix can
play an important role in monitoring IT infrastructure. This is equally true
for small organizations with a few servers and for large companies with a
multitude of servers.
--------------------------------------------------------------------------------
Update Information:
Fix CVE-2022-23132, CVE-2022-23133, CVE-2022-23134
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jan 14 2022 Gwyn Ciesla <gwync(a)protonmail.com> - 1:5.0.19-1
- 5.0.19
- Fixed CVE-2022-23132, CVE-2022-23133, CVE-2022-23134.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2040746 - CVE-2022-23134 zabbix: Possible view of the setup pages by
unauthenticated users if config file already exists [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2040746
[ 2 ] Bug #2040755 - CVE-2022-23132 zabbix: Incorrect permissions of [/var/run/zabbix]
forces dac_override [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2040755
[ 3 ] Bug #2040759 - CVE-2022-23133 zabbix: Stored XSS in host groups configuration
window in Zabbix Frontend [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2040759
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2022-1a667b0f90' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------