Netdata v2.3.1 Security Patch: Fixes Absolute Path Exposure and Insecure SVG Endpoints

Vulnerability Overview Netdata v2.3.1 is a patch version designed to address issues discovered since v2.3.0. This version provides the following vulnerability fixes and updates: Scope of Impact Debug Information Handling: Debug information is included in the default build, while separate debuginfo packages are disabled for Debian-based distributions. Static Build Configuration: Avoids unnecessary compilation of libunwind. Low Memory Condition Detection: Improves detection of low-memory conditions and enhances monitoring of memory usage. Installation Path Validation: Fixes installation path issues in the updater script crontab configuration. Database Page Size Limit: Fixes validation issues related to database page size limits for 32-bit compressed formats. Compilation Issues: Resolves compilation problems when building without a database engine or with address sanitizers enabled. System Resource Monitoring: Adds system resource monitoring to the status file, including memory usage and memory protection information. Security Vulnerability: Prevents the exposure of absolute file paths in web server responses. Permissions Issues: Fixes permissions issues in daemon status file handling to prevent race conditions. SVG Generation Endpoint: Removes the insecure SVG generation endpoint to prevent potential code injection vulnerabilities. Memory Access Issues: Fixes misaligned memory access issues by properly aligning memory structures. ACLK Synchronization: Ensures thread initialization is completed before startup to prevent race conditions. ACLK Initialization Issues: Fixes the issue of commands being queued before ACLK initialization is complete. Database Engine Crash: Fixes potential crashes in the database engine when encountering empty data files during range operations. Agent Status Reporting: Improves Agent status reporting in first-run scenarios. Crash Diagnostics: Adds initial implementation of libbacktrace to improve crash diagnostics. Agent Exit Handling: Improves reliability calculations for normal Agent exit scenarios. Enhanced Crash Reporting: Enhances crash reports with timeout and system information, including cloud provider details. Remediation Debug Information Handling: Debug information is included in the default build, while separate debuginfo packages are disabled for Debian-based distributions. Static Build Configuration: Avoids unnecessary compilation of libunwind. Low Memory Condition Detection: Improves detection of low-memory conditions and enhances monitoring of memory usage. Installation Path Validation: Fixes installation path issues in the updater script crontab configuration. Database Page Size Limit: Fixes validation issues related to database page size limits for 32-bit compressed formats. Compilation Issues: Resolves compilation problems when building without a database engine or with address sanitizers enabled. System Resource Monitoring: Adds system resource monitoring to the status file, including memory usage and memory protection information. Security Vulnerability: Prevents the exposure of absolute file paths in web server responses. Permissions Issues: Fixes permissions issues in daemon status file handling to prevent race conditions. SVG Generation Endpoint: Removes the insecure SVG generation endpoint to prevent potential code injection vulnerabilities. Memory Access Issues: Fixes misaligned memory access issues by properly aligning memory structures. ACLK Synchronization: Ensures thread initialization is completed before startup to prevent race conditions. ACLK Initialization Issues: Fixes the issue of commands being queued before ACLK initialization is complete. Database Engine Crash: Fixes potential crashes in the database engine when encountering empty data files during range operations. Agent Status Reporting: Improves Agent status reporting in first-run scenarios. Crash Diagnostics: Adds initial implementation of libbacktrace to improve crash diagnostics. Agent Exit Handling: Improves reliability calculations for normal Agent exit scenarios. Enhanced Crash Reporting: Enhances crash reports with timeout and system information, including cloud provider details. Support Options Netdata provides multiple support channels, including Netdata Learn, GitHub Issues, GitHub Discussions, Community Forums, and the Discord Server. Assets Asset download options are provided at the bottom of the page. Summary The Netdata v2.3.1 version addresses multiple potential security and stability issues through a series of fixes and enhancements, improving the overall performance and security of the system.

Goal Reached Thanks to every supporter — we hit 100%!

Netdata v2.3.1 Security Patch: Fixes Absolute Path Exposure and Insecure SVG Endpoints

More from this source