From 055a1e249c8d15dbee3a3c10dc7d0acde03e0c91 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 15 Sep 2026 11:56:52 +0200 Subject: [PATCH] package/zabbix: security bump to v7.2.15 Zabbix 7.2 is EOL since December 2025 [1] For more info on the version bump, see: - https://www.zabbix.com/rn/rn7.2.14 - https://www.zabbix.com/rn/rn7.2.15 This fixes the following vulnerabilties: - CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands. https://www.cve.org/CVERecord?id=CVE-2026-23920 - CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. https://www.cve.org/CVERecord?id=CVE-2026-23921 [1] https://endoflife.date/zabbix Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain --- package/zabbix/zabbix.hash | 4 ++-- package/zabbix/zabbix.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/zabbix/zabbix.hash b/package/zabbix/zabbix.hash index 787a0acfe9..f312dd4a49 100644 --- a/package/zabbix/zabbix.hash +++ b/package/zabbix/zabbix.hash @@ -1,3 +1,3 @@ -# Locally computed -sha256 44b51a09897e83b7d25cd706f88c0462224991d780881d6157d88fd804cc3a6c zabbix-7.2.13.tar.gz +# https://cdn.zabbix.com/zabbix/sources/oldstable/7.2/zabbix-7.2.15.tar.gz.sha256 +sha256 b7013063b9c6256a185f6e6001eff7d43b831b183aa39133d6ee524d0570e85c zabbix-7.2.15.tar.gz sha256 0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0 COPYING diff --git a/package/zabbix/zabbix.mk b/package/zabbix/zabbix.mk index 50bdfed609..09673d43c9 100644 --- a/package/zabbix/zabbix.mk +++ b/package/zabbix/zabbix.mk @@ -5,7 +5,7 @@ ################################################################################ ZABBIX_VERSION_MAJOR = 7.2 -ZABBIX_VERSION = $(ZABBIX_VERSION_MAJOR).13 +ZABBIX_VERSION = $(ZABBIX_VERSION_MAJOR).15 ZABBIX_SITE = https://cdn.zabbix.com/zabbix/sources/oldstable/$(ZABBIX_VERSION_MAJOR) ZABBIX_SELINUX_MODULES = zabbix ZABBIX_LICENSE = AGPL-3.0