LoginSign Up
← Back to all sparks
I

Icinga

INFRA · APIS
Velocity5.0

Open-source infrastructure and network monitoring system

icinga.com ↗

Three branches patched in lockstep for an unauthenticated takeover — then patched again for the fix's regression.

infrastructure-monitoringsecurity-advisoryapi-permissionsopentelemetrymulti-branch-supportregressions
◆Current state
Icinga 2 maintains three live branches — 2.14.x, 2.15.x and 2.16.x — and this window shows all three moving together twice. On 13 July, a coordinated security release across every branch closed vulnerabilities that allowed an unauthenticated attacker to take over or crash the process over the network, and introduced a filter-expression permission so API users can be denied DSL filters they don't need. Two weeks earlier, the same three branches each shipped a hotfix for a Json.decode() DSL regression that leaked an internal second argument into user-facing scripts.
◆Where it's heading
The API surface is being narrowed and the transport layer modernized at the same time. v2.16.0 relicensed the project to GPLv3 or later, added an OTLPMetricsWriter and deprecated ElasticsearchWriter for removal in v2.18, and moved HTTP handlers to chunked streaming to cut memory held per response. The releases since have been the cost of that pace: v2.16.1 reverted the perfdata writer connection change outright, and v2.16.4 fixed an API authentication regression that v2.16.0 introduced. The new filter-expression permission fits the same direction — assume API clients should hold less power by default.
◆Prediction
Expect continued triple-branch patch sets while 2.16 stabilizes, and further movement of perfdata users toward the OpenTelemetry writer ahead of the announced ElasticsearchWriter removal in v2.18.

◆Recent moves

  1. 16d ago

    Fixes API auth regression and hanging endpoint connections

    Cleanup after the 2.16 push: the API authentication regression introduced in v2.16.0 with certain HTTP client libraries is fixed, endpoint connections can no longer hang indefinitely and block further attempts until restart, and newer OpenSSL versions are supported. The bugs it closes are mostly self-inflicted by the pace of the 2.16 line.

    View source ↗
  2. 19d ago

    Security release for the 2.14 branch, adds filter-expression permission

    The 2.14 branch's share of the coordinated 13 July security release, closing flaws that let an unauthenticated attacker take over or crash the process over the network. It also carries the new filter-expression permission, so even the oldest maintained branch gains the ability to deny DSL filters to API users that don't need them.

    View source ↗
  3. 19d ago

    Security release for the 2.15 branch

    The 2.15 branch's version of the same 13 July advisory, identical in content to the 2.14 and 2.16 releases tagged within two minutes of it. One fix, three branches — the reason this feed's release count runs ahead of its change count.

    View source ↗
  4. 19d ago

    Security release for the current 2.16 branch

    The current branch's copy of the 13 July security release. It is also the release whose Json.decode() change had to be hotfixed in v2.16.3 two weeks later, and whose predecessor's API auth regression v2.16.4 cleans up.

    View source ↗
  5. 1mo ago

    Restores single-argument Json.decode() in the DSL

    A one-line hotfix undoing an accidental DSL break: an internal second argument to JsonDecode had leaked out as a required parameter, breaking existing scripts. Tagged simultaneously across all three branches, since all three had inherited the same mistake.

    View source ↗
  6. 1mo ago

    2.14 branch hotfix for the Json.decode() regression

    The 2.14 counterpart of the Json.decode() hotfix, carrying the identical single change. Notable mainly for how quickly it followed the security release that caused it.

    View source ↗