mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-30 22:11:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/zabbix: security bump to v7.2.15

Browse Source 
Zabbix 7.2 is EOL since December 2025 [1]

For more info on the version bump, see:
 - https://www.zabbix.com/rn/rn7.2.14
 - https://www.zabbix.com/rn/rn7.2.15

This fixes the following vulnerabilties:

- CVE-2026-23920:
    Host and event action script input is validated with a regex (set by
    the administrator), but the validation runs in multiline mode. If ^
    and $ anchors are used in user input validation, an injected newline
    lets authenticated users bypass the check and inject shell commands.
    https://www.cve.org/CVERecord?id=CVE-2026-23920

- CVE-2026-23921:
    A low privilege Zabbix user with API access can exploit a blind SQL
    injection vulnerability in include/classes/api/CApiService.php to
    execute arbitrary SQL selects via the sortfield parameter. Although
    query results are not returned directly, an attacker can exfiltrate
    arbitrary database data through time-based techniques, potentially
    leading to session identifier disclosure and administrator account
    compromise.
    https://www.cve.org/CVERecord?id=CVE-2026-23921

[1] https://endoflife.date/zabbix

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 055a1e249c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit is contained in:
Thomas Perale
2026-09-15 11:56:52 +02:00
committed by Raphaël Mélotte
parent d5943e5047
commit 4725deea9c
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/zabbix/zabbix.hash
View File

@@ -1,3 +1,3 @@
# Locally computed
sha256 44b51a09897e83b7d25cd706f88c0462224991d780881d6157d88fd804cc3a6c zabbix-7.2.13.tar.gz
# https://cdn.zabbix.com/zabbix/sources/oldstable/7.2/zabbix-7.2.15.tar.gz.sha256
sha256 b7013063b9c6256a185f6e6001eff7d43b831b183aa39133d6ee524d0570e85c zabbix-7.2.15.tar.gz
sha256 0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0 COPYING

2
package/zabbix/zabbix.mk
View File

@@ -5,7 +5,7 @@
################################################################################
ZABBIX_VERSION_MAJOR = 7.2
ZABBIX_VERSION = $(ZABBIX_VERSION_MAJOR).13
ZABBIX_VERSION = $(ZABBIX_VERSION_MAJOR).15
ZABBIX_SITE = https://cdn.zabbix.com/zabbix/sources/oldstable/$(ZABBIX_VERSION_MAJOR)
ZABBIX_SELINUX_MODULES = zabbix
ZABBIX_LICENSE = AGPL-3.0