https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:02:06 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-52817 <p>Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that monitoring account can supply the APT::Update::Pre-Invoke option to execute an arbitrary command while apt-get runs with root privileges, resulting in a root shell and complete compromise of the host. The vulnerable rule supports the check-plugins/deb-updates/deb-updates plugin, but it authorized arbitrary apt-get argument sequences rather than only the required apt-get update --quiet 2 command. This issue is fixed in version 5.1.0.</p> <p>Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that monitoring account can supply the APT::Update::Pre-Invoke option to execute an arbitrary command while apt-get runs with root privileges, resulting in a root shell and complete compromise of the host. The vulnerable rule supports the check-plugins/deb-updates/deb-updates plugin, but it authorized arbitrary apt-get argument sequences rather than only the required apt-get update --quiet 2 command. This issue is fixed in version 5.1.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-52817 https://vulnerability.circl.lu/vuln/ghsa-8w6w-23mq-h8rg <p><strong>Affected:</strong> PyPI: linuxfabrik-lib</p> <p>### Summary In the [Debian.sudoers](https://github.com/Linuxfabrik/monitoring-plugins/blob/main/assets/sudoers/Debian.sudoers) file, `apt-get` is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user:</p> <p>### PoC By choosing a particular argument, you can get (as a nagios user) a root shell: ``` sudo apt-get update -o APT::Update::Pre-Invoke::=&#34;/bin/sh&#34; ``` Since the nagious user can use sudo to run apt-get as root, the resulting shell is also running as root.</p> <p>### Impact The vulnerability is a local privilege escalation, impacting users who use the provided sudoers file. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).</p> <p>### Fix Since only one place where `apt-get` is currently used (in [deb-updates](https://github.com/Linuxfabrik/monitoring-plugins/blob/998302a5fb43e89df1359f4cbb6558f81c96ae4f/check-plugins/deb-updates/deb-updates#L124)) was found, it should be enough to allow only the specific arguments used there.</p> <p>Here an example how the line in the sudoers file could look like: ``` /usr/lib64/nagios/plugins/strongswan-connections,\ /usr/lib64/nagios/plugins/systemd-unit,\ /usr/bin/apt-get update --quiet 2 ```</p> <p><strong>Affected:</strong> PyPI: linuxfabrik-lib</p> <p>### Summary In the [Debian.sudoers](https://github.com/Linuxfabrik/monitoring-plugins/blob/main/assets/sudoers/Debian.sudoers) file, `apt-get` is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user:</p> <p>### PoC By choosing a particular argument, you can get (as a nagios user) a root shell: ``` sudo apt-get update -o APT::Update::Pre-Invoke::=&#34;/bin/sh&#34; ``` Since the nagious user can use sudo to run apt-get as root, the resulting shell is also running as root.</p> <p>### Impact The vulnerability is a local privilege escalation, impacting users who use the provided sudoers file. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).</p> <p>### Fix Since only one place where `apt-get` is currently used (in [deb-updates](https://github.com/Linuxfabrik/monitoring-plugins/blob/998302a5fb43e89df1359f4cbb6558f81c96ae4f/check-plugins/deb-updates/deb-updates#L124)) was found, it should be enough to allow only the specific arguments used there.</p> <p>Here an example how the line in the sudoers file could look like: ``` /usr/lib64/nagios/plugins/strongswan-connections,\ /usr/lib64/nagios/plugins/systemd-unit,\ /usr/bin/apt-get update --quiet 2 ```</p> https://vulnerability.circl.lu/vuln/ghsa-8w6w-23mq-h8rg https://vulnerability.circl.lu/vuln/pysec-2026-2595 <p><strong>Affected:</strong> PyPI: linuxfabrik-lib</p> <p>### Summary In the [Debian.sudoers](https://github.com/Linuxfabrik/monitoring-plugins/blob/main/assets/sudoers/Debian.sudoers) file, `apt-get` is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user:</p> <p>### PoC By choosing a particular argument, you can get (as a nagios user) a root shell: ``` sudo apt-get update -o APT::Update::Pre-Invoke::=&#34;/bin/sh&#34; ``` Since the nagious user can use sudo to run apt-get as root, the resulting shell is also running as root.</p> <p>### Impact The vulnerability is a local privilege escalation, impacting users who use the provided sudoers file. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).</p> <p>### Fix Since only one place where `apt-get` is currently used (in [deb-updates](https://github.com/Linuxfabrik/monitoring-plugins/blob/998302a5fb43e89df1359f4cbb6558f81c96ae4f/check-plugins/deb-updates/deb-updates#L124)) was found, it should be enough to allow only the specific arguments used there.</p> <p>Here an example how the line in the sudoers file could look like: ``` /usr/lib64/nagios/plugins/strongswan-connections,\ /usr/lib64/nagios/plugins/systemd-unit,\ /usr/bin/apt-get update --quiet 2 ```</p> <p><strong>Affected:</strong> PyPI: linuxfabrik-lib</p> <p>### Summary In the [Debian.sudoers](https://github.com/Linuxfabrik/monitoring-plugins/blob/main/assets/sudoers/Debian.sudoers) file, `apt-get` is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user:</p> <p>### PoC By choosing a particular argument, you can get (as a nagios user) a root shell: ``` sudo apt-get update -o APT::Update::Pre-Invoke::=&#34;/bin/sh&#34; ``` Since the nagious user can use sudo to run apt-get as root, the resulting shell is also running as root.</p> <p>### Impact The vulnerability is a local privilege escalation, impacting users who use the provided sudoers file. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).</p> <p>### Fix Since only one place where `apt-get` is currently used (in [deb-updates](https://github.com/Linuxfabrik/monitoring-plugins/blob/998302a5fb43e89df1359f4cbb6558f81c96ae4f/check-plugins/deb-updates/deb-updates#L124)) was found, it should be enough to allow only the specific arguments used there.</p> <p>Here an example how the line in the sudoers file could look like: ``` /usr/lib64/nagios/plugins/strongswan-connections,\ /usr/lib64/nagios/plugins/systemd-unit,\ /usr/bin/apt-get update --quiet 2 ```</p> https://vulnerability.circl.lu/vuln/pysec-2026-2595