From 37ce0c6c4a4e46fefaf8b44b37def625b991078e Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 10 Oct 2025 18:20:53 +0200 Subject: [PATCH] package/zabbix: security bump to v7.2.13 For more details on the version bump, see: - https://www.zabbix.com/rn/rn7.2.13 - https://www.zabbix.com/rn/rn7.2.12 - https://www.zabbix.com/rn/rn7.2.11 - https://www.zabbix.com/rn/rn7.2.10 - https://www.zabbix.com/rn/rn7.2.9 - https://www.zabbix.com/rn/rn7.2.8 - https://www.zabbix.com/rn/rn7.2.7 - https://www.zabbix.com/rn/rn7.2.6 Fixes the following vulnerabilities: - CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change. For more information, see: - https://support.zabbix.com/browse/ZBX-27062 - https://nvd.nist.gov/vuln/detail/CVE-2025-27231 - CVE-2025-27236 A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to. For more information, see: - https://support.zabbix.com/browse/ZBX-27060 - https://nvd.nist.gov/vuln/detail/CVE-2025-27236 - CVE-2025-27238 Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-27238 - https://support.zabbix.com/browse/ZBX-26988 - CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. For more information, see: - https://support.zabbix.com/browse/ZBX-27063 - https://nvd.nist.gov/vuln/detail/CVE-2025-49641 Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit 762ddee71c0e5bbda72c11dc32898b5d9fd01ef8) Signed-off-by: Thomas Perale --- package/zabbix/zabbix.hash | 2 +- package/zabbix/zabbix.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/zabbix/zabbix.hash b/package/zabbix/zabbix.hash index 979b6c8e3f..787a0acfe9 100644 --- a/package/zabbix/zabbix.hash +++ b/package/zabbix/zabbix.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 0d01b393dd22b2a60b36fb37a98fcf1081c683ad98832a2ddd87943a1200839e zabbix-7.2.5.tar.gz +sha256 44b51a09897e83b7d25cd706f88c0462224991d780881d6157d88fd804cc3a6c zabbix-7.2.13.tar.gz sha256 0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0 COPYING diff --git a/package/zabbix/zabbix.mk b/package/zabbix/zabbix.mk index 3e685f1ea2..caa69fda38 100644 --- a/package/zabbix/zabbix.mk +++ b/package/zabbix/zabbix.mk @@ -5,7 +5,7 @@ ################################################################################ ZABBIX_VERSION_MAJOR = 7.2 -ZABBIX_VERSION = $(ZABBIX_VERSION_MAJOR).5 +ZABBIX_VERSION = $(ZABBIX_VERSION_MAJOR).13 ZABBIX_SITE = https://cdn.zabbix.com/zabbix/sources/stable/$(ZABBIX_VERSION_MAJOR) ZABBIX_SELINUX_MODULES = zabbix ZABBIX_LICENSE = AGPL-3.0