SB2026081869 - Multiple vulnerabilities in Icinga

Description

This security bulletin contains information about 2 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the JSON-RPC message handling logic when processing announced large messages on JSON-RPC connections. A remote user can announce a large message size to cause a denial of service.

Exploitation may cause the Icinga 2 process to crash in an out-of-memory scenario. Allocations larger than roughly 1 GB require compromise of more than one endpoint certificate because each endpoint is limited to one allocation at a time.

2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in /v1/events filter expressions when handling requests to the /v1/events API endpoint. A remote privileged user can send a specially crafted request containing filter expressions to disclose sensitive information.

Exploitation requires some events/* permission that allows access to the /v1/events API endpoint.

Remediation

Install update from vendor's website.

References

• https://github.com/Icinga/icinga2/security/advisories/GHSA-wm63-p2jg-5665
• https://github.com/Icinga/icinga2/security/advisories/GHSA-v265-w3gm-99vg