Security Releases for Icinga 2 and Icinga Web

Icinga 2
1

Icinga 2 v2.16.6 and v2.15.7 and Icinga Web v2.14.1 and v2.13.2 are out.
All four releases fix security issues, so we recommend upgrading as soon as possible.

The most severe ones:
Icinga Web: the standalone chart endpoints let attackers read files and overload the server without logging in. We removed the endpoints entirely.

Icinga 2: the default mail notification scripts allowed command line argument injection through the recipient email address. With GNU mailutils, this can lead to arbitrary command execution.

The releases also fix API issues that could crash the daemon or expose objects users shouldn’t see, plus log injection and a few privilege problems in Icinga Web.

Icinga Web v2.12 and earlier receive no fixes. If you’re still on one of those, move to v2.13.2 or later.

Thanks to everyone who reported these issues responsibly, including Alessandro Mizzaro, moreamazingnick, and archnexus707.

All details, advisories and upgrade notes: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/

3

or if you really need to stay in IcingaWeb2 2.12.* which is a bad idea you can block the path using apache2 config

<LocationMatch "^/icingaweb2/(svg|png)/chart\.php$">
    Require all denied
</LocationMatch>

The rule above works for standard installations but needs adaptation for installations which do not have icingaweb2 in the url path like:

4

I had the same issue with a custom basepath for icingaweb2 I just added a leadding slash in the LocationMatch pattern and it worked for me