Fixed
- Fixed issue with Availability report rounding/data error in service averages in the data table [TPS#15609] -JO
- Fixed issue in which NCPA CPU Usage metric did not display [TPS#15673] -PhW
- Fixed both objects/servicestatus and objects/hoststatus to allow filtering by last_hard_state [TPS#15710] -JO
- Fixed restore_xi.sh script to include all libexec plugins not just ones with file extension [TPS#15696] -JO
- Fixed file permissions by having automysqlbackup script keep perms in /store/backups/mysql not world readable [TPS#15699] -JO
- Fixed default mysql config file options during a clean install (does not get changed on upgrade) [TPS#15692,TPS#15698] -JO
- Fixed AD ldapSlashes to properly fix escaping parens [TPS#15709] -JO
- Fixed cacerts directory for AD/LDAP certificate management [TPS#15713] -JO
Component Updates
Core Config Manager (CCM) 3.1.6
- Fixed issue where search was case-sensitive -JO
- Fixed XSS security issue in search and deletion (thanks Hieu Tran(jkana101) from VCB STeam)) -JO
Security
- Updated migrate.php script to ensure that the nagios_bundler.py is not a security issue by copying it after tarball extraction -JO
- Updated NSCA to version 2.10.1 to fix security issues -SAW
- Fixed XSS vulnerability in Nagios Core ui by patching Core for XI systems with escape_string() -JO
- Fixed XSS vulnerability in SSH Terminal page url parameter and the Account Information page api_key parameter -JO
- Fixed XSS vulnerability in Audit Log page Send to NLS form -JO
- Fixed security permissions issue with apache user and temp directory used by Highcharts -JO
- Fixed security permissions issue with nocscreen component sounds directory -JO
- Fixed manage_services.shs script vulnerability with systemctl not using the -no-pager option -JO
- Fixed various security issues: (thanks [email protected] and [email protected] from Codesafe Team of Legendsec at Qi’anxin Group)
- Fixed various XSS vulnerabilities in the auditlog.php admin page -JO
- Fixed SQL injection possibility in mib_name parameter when uploading new MIBs in Manage MIBs page -JO
- Fixed XSS vulnerability in the Admin > system performance settings page -JO
- Fixed XSS vulnerabilities in the Admin > system settings page -JO
- Fixed security vulnerability in nagiosna component in version 1.4.5 -JO
- Fixed security vulnerability in MTR component in version 1.0.4 -JO
- Fixed security issue in NRDS with version 1.2.8 -JO
Updated
- Updated install to support Debian 11 systems -JO
- Updated System Settings for “allow html” to separate options for status and comments under Other Settings and added a warning -JO
- Updated NRDP to version 2.0.5 to fix issue with receiving spooled passive checks [TPS#15621] -JO
Fixed
- Fixed issue with “Finish as Template” button not adding services do to new wizards using json encode/decode rather than serialize [TPS#15635] -JO
- Fixed capactiyplanning.py giving out a lot of ValueErrors when pending checks are just starting to run -JO
- Fixed issue where cloning user would not clone the user’s meta data [TPS#15617] -JO
- Fixed bulk modifications issue when trying to remove Free Variables [TPS#15653] -JO
- Fixed sysstat data on systemd systems when XML entities are in the output text causing the Admin > System Status to show “No Data” [TPS#15657] -JO
- Fixed issue with cfgmaker with contact/location newlines causing it not to work [TPS#15666] -JO,SS
Component Updates
Core Config Manager (CCM) 3.1.5
- Fixed Down stalking option not working for Host Templates in Alert Settings tab [TPS#15625] -JO
- Fixed XSS vulnerability in ajax.php script -JO
- Fixed issue with case insensitivity in regards to host/service names when importing configs (or running wizard) [TPS#15620] -JO
Security
- Updated NagVis component to version 2.0.9 to fix security issue (thanks Scott Tolley from Synopsys Cybersecurity Research Center (CyRC)) -JO
- Fixed command injection security issue during installation of components, wizards, and dashlets in cmdsubsys -JO
- (thanks Guillaume André of Synacktiv (https://synacktiv.com)) (CVE-2021-40345)
- Fixed security issue in backend API auth where it was not properly authing the insecure login ticket -JO
- Fixed security vulnerability with file permissions for the migrate nagios_unbundler.py script -JO
- (thanks Guillaume André of Synacktiv (https://synacktiv.com)) (CVE-2021-40343)
- Fixed SQL injection in the Manage MIBs admin page and Bulk Modifications page -JO
- Fixed XSS security vulnerability in Manage My Dashboards page edit dashboard title attribute (thanks Matthew Dunn) (CVE-2021-38156) -JO
- Fixed SSRF vulnerability in Scheduled Report URL when scheduled pages URL is outside the Nagios XI system
- (thanks Ben Leonard-Lagarde (Modux)) (CVE-2021-37223) (TPS#15594) -PhW,JO
Updated
- Updated Bulk Modifications Tool UI to use actual option names, and mirror UI from normal config page -PhW
Added
- Added Stalking Notification and None options to Single Config Option for Bulk Modifications Tool [TPS#15597] -PhW
Fixed
- Fixed issue with special characters in Top Alert Producers, State History, and Notifications reports [TPS#15599] -JO
- Fixed built in DEV tools, so you can log values and monitor them through the web UI. -PhW
- Fixed styling issue on the Check for Updates page when in Modern Dark theme -JO
- Fixed issue in which deleting a host having an escalation caused an invalid config. -PhW
Component Updates
Core Config Manager (CCM) 3.1.4
- Fixed reflective XSS in the test command due to double encoded html entities -JO
- (thanks Amit Raut of Trend Micro Security Research working with Trend Micro Zero Day Initiative)
Security
- Fixed SQL injection vulnerability in Bulk Modifications Tool for some single config option types -JO
- Fixed post auth RCE in autodiscovery due to path tranversal issue in job id -JO
- Fixed possible insecurity in Nagios Mobile authentication where it would not exit/quit after redirecting unauthenticated users -JO
- Fixed redirection vulnerability in login redirect url for some styles of urls -JO
- Fixed vulnerability with xi-sys.cfg being imported from the var directory for some scripts with elevated perms -JO
- Fixed insecure permissions on migrate.php and repairmysql.sh file (thanks Ben Leonard-Lagarde (Modux) & Lucas Fedyniak-Hopes (Modux)) (CVE-2021-36363, CVE-2021-36365) -JO
- Fixed security issue with backup_xi.sh and manage_services.sh allowing using wildcards -JO
- (thanks Ben Leonard-Lagarde (Modux) & Lucas Fedyniak-Hopes (Modux)) (CVE-2021-36364, CVE-2021-36366) -JO
Fixed
- Fixed issue where critical or warning values in certain disk space metrics were rendered as green. -PhW
- Fixed password email going out when AD/LDAP user is created without local password auth [TPS#15547] -JO
- Fixed failed backup email sent when running a manual local backup [TPS#15546] -JO
- Fixed timezone for Istanbul in utils-time.inc.php [TPS#15532] -JO
- Fixed longserviceoutput macro not properly converting newlines to breaks in HTML email notifications [TPS#15537] -JO
- Fixed issue when generating PDFs (and auth tokens in general) on usernames with uppercase letters in them [TPS#15542] -JO
- Fixed display issue of host/service notes where double quotes were not displayed correctly [TPS#15543] -JO
- Fixed issue with index.php page value not being properly validated before being passed to display page function -JO
- Fixed issue where AD/LDAP wouldn’t search in base directory [TPS#15495] -JO
- Fixed empty XML output when outputtype=xml for hostgroup/servicegroup API endpoints when there are no groups -JO
- Fixed issue with manage_services.sh and restarting php-fpm on EL8 systems -JO
- Fixed issue with Nagios Mobile not verifying a comment is set for scheduled downtime or acknowledge -JO
Added
- Added extra folder name sanatization to the getprofile.sh script to make it more secure -JO
Component Updates
Core Config Manager (CCM) 3.1.3
- Fixed SQL injection from improper escaping of values in search text -JO
- Fixed timeperiod template name adding _copy_x to the template name even if empty which caused errors [TPS#15550] -JO
NDOUtils (NDO) 3.0.7
- Added option “log_failed_queries” to ndo.cfg. Set this to 0 to disable failed query logging -SAW
- Fixed issue where nagios_objects.name2 would occasionally be set to NULL -SAW
- Fixed issue where leftover comments and other objects would cause hosts and services to continue showing in the database after deletion. [TPS#15549] -SAW
- Widened all text columns significantly -SAW
Security
- Fixed vulnerability in getprofile.sh not clearing directory before creating profile -JO
- Fixed SQL injection vulnerability in Bulk Modifications Tool -JO
- Fixed XSS security vulnerability in about section -JO
- Fixed security issue for config when upgrading system [TPS#15551] -JO
Updated
- Updated getprofile.sh to delete a new profile’s folder before generating contents -JO
Fixed
- Fixed install on newer Debian 9 systems due to default pip version [TPS#15535] -JO
- Fixed issues with logrotate -JO,DC
- Fixed getprofile.sh db_host value to properly pull from config.inc.php -JO,DC
- Fixed restore_xi.sh using relative directory path -JO,DC
- Fixed the “use” option to properly apply when using the config/contacts API endpoint -SS,JO
Component Updates
Core Config Manager (CCM) 3.1.2
- Fixed XSS security vulnerability in CCM lock page functionality -JO
Security
- Updated email validation to require RFC 822 valid email addresses to fix possible security vulnerabilities -JO
- Fixed XSS vulnerability in user Email Address field when on Send Test Notification page -JO
- Fixed possible RCE vulnerability via Email Address not being properly validated (CVE-2020-24899) -JO
Updated
- Updated jQuery to version 3.6.0 to fix minor issues -JO
Fixed
- Fixed install process on Oracle Linux 8 due to mod_php being used instead of php-fpm like CentOS/RHEL -JO
- Fixed config/ endpoints to properly display array of contacts (and other objects) when using append (+) in config [TPS#15509] -JO
- Fixed argument quoting in mysqlrepair and restore_xi scripts -DC,JO
- Fixed issue with Scheduled Backups sending local backup success email with SSH or FTP emails [TPS#15501] -JO
- Fixed API help/example PUT config calls not working properly due to space not being url encoded [TPS#15505] -JO
- Fixed scheduled reports jobs not changing with username change [TPS#15502] -JO
- Fixed issue where masquerade button in the Manage Users page wasn’t working on some OS/PHP versions -JO
- Fixed issues with MIB integration after upgrading to SNMPTT 1.4.2 [TPS#15376] -SAW
- Fixed issues with Undo Trap Processing button [TPS#15500] -SAW
- Fixed issue with downgraded ndo2db systems where limited users would not properly load data due to is_ndo_loaded failing -JO
Security
- Updated php.ini settings to add some more restrictive session options for better security -JO
Updated
- Updated NRDP version to 2.0.4 to fix jQuery CVE and update Bootstrap version -JO
Removed
- Removed deprecated code related to NDO 2 (get_db_backend_status, get_ndoutils_info_xml, API’s system/statusdetail dbbackend) -SAW
Fixed
- Fixed issue with Enterprise message showing up on Rapid Response URL page even though it shouldn’t -JO
- Fixed jquery 3 compat script not loading for wkhtmltopdf report generation when jQuery 1.x is disabled -JO
- Fixed wkhtmltopdf delay/timeout not being set properly for page pdf generation -JO
- Fixed default date, number, and week format set when creating a new user to match config settings [TPS#15428] -JO
- Fixed special characters in ansible passwords with Deploy and Migrate scripts [TPS#15443] -JO
- Fixed typo in Performance Settings Database tab [TPS#15446] -JO
- Fixed issue with custom API endpoints not being passed the $args as an array -JO
- Fixed Nagios Configuration location being passed to the migrate script when using advanced options in Migrate Server page -JO
- Fixed Bulk Modifications Tool to make ARG8 work properly and fix checkboxes when setting a new command [TPS#15458] -JO
- Fixed issue with snmptraphandling.py script not working properly with Python 3 [TPS#15461] -JO
- Fixed My Scheduled Reports History tab to work properly with old PostgresQL installs of XI [TPS#15467] -JO
- Fixed user permissions on newer MySQL servers to allow backup_xi.sh to do a mysqldump [TPS#15462] -JO
- Fixed issue with backslash in service names not showing up when editing a Nagios BPI group [TPS#15457] -JO
- Fixed snmptrapd not enabled/starting on some Debian and Ubuntu installations [TPS#15473] -JO
- Fixed Two Factor email authentication in Nagios Mobile interface [TPS#15399] -JO
- Fixed rrdexport API endpoint to allow passing the maxrows value to no longer be limited to the default [TPS#15433] -JO
- Fixed issue installing on RHEL 8.3 due to codeready builder repo requirement [TPS#15463] -JO
- Fixed permissions issues with Deploy Dashboards component -JO
- Fixed permissions on the send_to_nls.php file to be owned by root and read only to other users -JO
- Fixed Nagios BPI sync when applying configuration not waiting for NDO3 to load all data before running [TPS#15448] -JO
- Fixed issue where php-fpm was not being restarted during CA cert add in LDAP/AD cert management page -JO
Component Updates
Core Config Manager (CCM) 3.1.1
- Fixed issue where overlay would not allow scrolling for Free Variables list [TPS#15452] -JO
- Fixed copying host/services with backslash in the name not copying the full name with backslash [TPS#15460] -JO
- Fixed XSS security vulnerabilities in config_name and service_description on the Services page -JO
- Fixed XSS security vulnerabilities in Overlay modals -JO
- Fixed issue with writing out host with backslash in the host_name -JO
NDOUtils (NDO) 3.0.6
- Increased performance for queries involving comment history and downtimes on large/long-running systems
- Fixed error when adding downtimes which expire after 2038
Fixed
- Fixed issue with Admin > Manage Components page where the proper component name was not being set -JO
Security
- Fixed security vulnerability where PNP’s PHP templates were accessible from the interface -JO
- Fixed stored XSS security vulnerability in My Tools page (thanks Matthew Aberegg) -JO
- Fixed security vulnerability in Manage Plugins upload when using convert line endings option (CVE-2020-35578) (thanks Haboob Team) -JO
- Fixed XSS security vulnerability in Nagios BPI config IDs (thanks Matt Aberegg) -JO
- Fixed XSS security vulnerability in views url (thanks Matt Aberegg) -JO
- Fixed XSS security vulnerability in SSH Terminal page (CVE-2021-25299) (thanks Nipun Gupta of Cloudfuzz) -JO
- Fixed security vulnerability in Graph Template upload and PNP share directory (thanks Xinjie Ma from Chaitin Security Research Lab) -JO
Updated
- Updated Rapid Response page sizing on mobile devices -JO
- Updated Linux Server Config Wizard to use NCPA instead of NRPE -LG
- Updated Highcharts to version 7.2.2 for bug fixes -JO
Added
- Added Migrate Server utility to Admin section to migrate Nagios Core systems to Nagios XI -JO,SAW
- Added new Configuration Snapshots page with ability to see raw diffs between configuration changes that have been applied -JO
- Added services tab into Host Status Details page to see service status without leaving the page -JO
- Added ability to deploy agents from the Auto Discovery tool and show if agents have been deployed to hosts that are discovered -JO
- Added Microsoft 365 Config Wizard -LG
- Added Linux Server Legacy Config Wizard that uses NRPE -LG
- Added notification options to Scheduled Backups to notify via email when backups succeed or if they fail -JO
- Added ease of use enhancements to the New Password input and Email User New Password checkbox in the Edit Users page -JO
- Added Scheduled Reports History tab to My Scheduled Reports page and Report Managment section to view reports ran and the status -JO
- Added ability to send URL parameters to PUT API config endpoints in case a parameter cannot be passed via the URL path -JO
- Added support for deploying agents on Windows machines (if openssh server is enabled and configured) via Deploy Agents -JO
Fixed
- Fixed Scheduled Backup logging so it logs output and errors directly into the scheduledbackups.log file when backups are ran -JO
- Fixed issue with the coreuiproxy not properly working with URL encoded strings [TPS#15381] -JO
- Fixed Scheduled Reporting logging file (/usr/local/nagiosxi/var/scheduledreporting.log) not being created by default -JO
- Fixed Bulk Modifications Tool to properly apply check_command on host/services that do not have one [TPS#15385] -JO
- Fixed Bulk Modifications Tool logging output not showing the proper host/service names in the audit log [TPS#15384] -JO
- Fixed issue with forward slashes in name/definition of object configs in Nagios BPI [TPS#15356] -JO
- Fixed service selection dropdown from changing sizes in Graph Explorer’s Multistacked graph tab [TPS#15368] -JO
- Fixed issue with Auto Discovery not having Actions buttons if a running job finishes before moving off or refreshing the page -JO
- Fixed theme/CSS issue with column sizes on large screens -JO
- Fixed Ansible package installation on Ubuntu 18.04 LTS systems -JO
- Fixed API endpoints config/host and config/service to make host_name and config_name values case sensitive -JO
- Fixed changing timezone in EL8 systems not restarting php-fpm which causes php to have the wrong timezone until restarted -JO
- Fixed issue with system/commands when using multiple command IDs [TPS#15408] -JO,SS
- Fixed styling on Rapid Response page when using a trial enterprise license -JO
- Fixed serial number for self signed SSL generated when selecting SSL option during install -JO
- Fixed sysstat cron job cpu stats on newer versions of iostat in CentOS/RHEL systems -JO,DC
- Fixed issue with Bulk Modifications Tool when removing a free variable where relationships would not show -JO
Component Updates
Core Config Manager (CCM) 3.1.0
- Added checkbox in Import Config Files page that hides all configs outside of the import directory -JO
- Added service excludes checkbox into Service Escalations -JO
- Updated service object Misc Settings tab to remove config options that are not able to be set for services -JO
- Updated Misc Settings information for how to use specific fields -JO
- Fixed issue where object names with multiple spaces in a row would not import properly [TPS#15374] -JO
- Fixed check command close button over the command output and command output sizing [TPS#15353] -JO
- Fixed Service Escalations showing * for contact/contact group options since it is not usable [TPS#15403] -JO
- Fixed Service not removing hosts properly when deleting a host and the service also has a hostgroup assigned [TPS#15415] -JO
- Fixed excluding services, hosts, host groups from Service Escalations [TPS#15321] -JO
- Fixed importing services on Service Escalations when host_name is set to * [TPS#15321] -JO
- Fixed XSS security vulnerability with the Active/Actions buttons in the templates pages (thanks Matt Aberegg) -JO
Security
- Fixed security vulnerability where PNP’s PHP templates were accessible from the interface -JO
- Fixed stored XSS security vulnerability in My Tools page (thanks Matthew Aberegg) -JO
- Fixed security vulnerability in Manage Plugins upload when using convert line endings option (CVE-2020-35578) (thanks Haboob Team) -JO
- Fixed XSS security vulnerability in Nagios BPI config IDs (thanks Matt Aberegg) -JO
- Fixed XSS security vulnerability in views url (thanks Matt Aberegg) -JO
- Fixed XSS security vulnerability in SSH Terminal page (CVE-2021-25299) (thanks Nipun Gupta of Cloudfuzz) -JO
- Fixed security vulnerability in Graph Template upload and PNP share directory (thanks Xinjie Ma from Chaitin Security Research Lab) -JO
Updated
- Updated Rapid Response page sizing on mobile devices -JO
- Updated Linux Server Config Wizard to use NCPA instead of NRPE -LG
- Updated Highcharts to version 7.2.2 for bug fixes -JO
Added
- Added Migrate Server utility to Admin section to migrate Nagios Core systems to Nagios XI -JO,SAW
- Added new Configuration Snapshots page with ability to see raw diffs between configuration changes that have been applied -JO
- Added services tab into Host Status Details page to see service status without leaving the page -JO
- Added ability to deploy agents from the Auto Discovery tool and show if agents have been deployed to hosts that are discovered -JO
- Added Microsoft 365 Config Wizard -LG
- Added Linux Server Legacy Config Wizard that uses NRPE -LG
- Added notification options to Scheduled Backups to notify via email when backups succeed or if they fail -JO
- Added ease of use enhancements to the New Password input and Email User New Password checkbox in the Edit Users page -JO
- Added Scheduled Reports History tab to My Scheduled Reports page and Report Managment section to view reports ran and the status -JO
- Added ability to send URL parameters to PUT API config endpoints in case a parameter cannot be passed via the URL path -JO
- Added support for deploying agents on Windows machines (if openssh server is enabled and configured) via Deploy Agents -JO
Fixed
- Fixed Scheduled Backup logging so it logs output and errors directly into the scheduledbackups.log file when backups are ran -JO
- Fixed issue with the coreuiproxy not properly working with URL encoded strings [TPS#15381] -JO
- Fixed Scheduled Reporting logging file (/usr/local/nagiosxi/var/scheduledreporting.log) not being created by default -JO
- Fixed Bulk Modifications Tool to properly apply check_command on host/services that do not have one [TPS#15385] -JO
- Fixed Bulk Modifications Tool logging output not showing the proper host/service names in the audit log [TPS#15384] -JO
- Fixed issue with forward slashes in name/definition of object configs in Nagios BPI [TPS#15356] -JO
- Fixed service selection dropdown from changing sizes in Graph Explorer’s Multistacked graph tab [TPS#15368] -JO
- Fixed issue with Auto Discovery not having Actions buttons if a running job finishes before moving off or refreshing the page -JO
- Fixed theme/CSS issue with column sizes on large screens -JO
- Fixed Ansible package installation on Ubuntu 18.04 LTS systems -JO
- Fixed API endpoints config/host and config/service to make host_name and config_name values case sensitive -JO
- Fixed changing timezone in EL8 systems not restarting php-fpm which causes php to have the wrong timezone until restarted -JO
- Fixed issue with system/commands when using multiple command IDs [TPS#15408] -JO,SS
- Fixed styling on Rapid Response page when using a trial enterprise license -JO
- Fixed serial number for self signed SSL generated when selecting SSL option during install -JO
- Fixed sysstat cron job cpu stats on newer versions of iostat in CentOS/RHEL systems -JO,DC
- Fixed issue with Bulk Modifications Tool when removing a free variable where relationships would not show -JO
Component Updates
NDOUtils (NDO) 3.0.5
- Drastically reduced startup time for some systems
- Fixed occasional long shutdown times in Nagios Core
- Fixed segmentation faults related to severed MySQL connections
- Fixed issue with service display_name being set to the service description
Security
- Fixed security issues with AngularJS 1.3.9 by upgrading to 1.8.2 -JO
- Fixed various XSS security issues with older version of Bootstrap 3.3.x by upgrading to 3.4.1 in both Desktop and Mobile -JO
- Fixed various XSS security vulnerabilities in Manage Users, Notification Settings, Agent Management, and Deploy Dashboard pages (thanks Namratha) -JO
- (CVE-2020-27988, CVE-2020-27989, CVE-2020-27990, CVE-2020-27991)
- Fixed privilege escalation security vulnerability with Auto-Discovery php script (thanks Chris Lyne of Tenable) (CVE-2020-28648) -JO
- Fixed authenticated remote code execution in Auto-Discovery component (thanks Shahar Zini and Samir Ghanem from Skylight Cyber Security) -JO
Fixed
- Fixed mobile redirect when trying to access the rapid response URL [TPS#15372] -JO
Component Updates
Core Config Manager (CCM) 3.0.8
- Fixed various XSS security vulnerabilities in overlay and notification/check period -JO
- Fixed issue with command escaping in Test Check Command [TPS#15167] -JO
Security
- Fixed SQL injection vulnerability in the edit page for SNMP Trap Interface (thanks Matthew Aberegg) -JO
- Fixed CSRF security vulnerabilities in Manage MIBs page and SNMP Trap Interface (CVE-2020-5790) (thanks Chris Lyne of Tenable) -JO
- Fixed RCE security vulnerability in the Manage MIBs page (CVE-2020-5791) (thanks Chris Lyne of Tenable) -JO
- Fixed Command Argument Injection vulnerability in SNMP Trap Interface (CVE-2020-5792) (thanks Chris Lyne of Tenable) -JO
Fixed
- Fixed issue with mysqladmin credentials not being set when creating a support Profile [TPS#15324] -JO
- Fixed typos in Deploy Agent page [TPS#15336] -JO
- Fixed issue with servicegroup_name not being populated in schedule downtime popup on Service Group Grid/Overview pages [TPS#15328] -JO
- Fixed search box autocomplete not working on Host/Service Details pages -JO
- Fixed Auto Discovery component when scheduling a recurring scan at either 12 AM or PM [TPS#15342] -JO
- Fixed issue when updating a single component using the install button on the Manage Components page [TPS#15337] -JO
- Fixed renaming objects via PUT request in API with only a name change causing apply config issues [TPS#15156] -JO
- Fixed Recurring Scheduled Downtime for limited users services not showing up [TPS#15354] -SS,JO
- Fixed Nagios BPI issues with newer systems with newer versions of git cmd using an invalid cmdline parameter -JO
- Fixed issue with filtered output in SLA/Availability report when advanced options are set [TPS#15358] -JO
- Fixed empty pending host/service check that could show up after hard system reset -JO
Component Updates
Core Config Manager (CCM) 3.0.7
- Fixed various XSS sercurity vulnerabilities in the object edit pages (thanks Matthew Aberegg) -JO
- Fixed various SQL injection security vulnerabilities in the object edit pages (thanks Matthew Aberegg) -JO
- Fixed bug in the CCM Audit Log page which would not allow searching -JO
NDOUtils (NDO) 3.0.4
- Fixed issue with downtime brokering on startup
- Fixed logging of failed queries for WRITE_HOSTS/WRITE_SERVICES/WRITE_CONTACTS
- Fixed blank host/service status rows that may get added during a hard restart
Security
- Fixed information tooltips in security popup during LDAP/AD user import [TPS#15247] -JO
- Fixed XSS security vulnerability in Admin -> Manage Users (Thanks Christian Weiler) [TPS#15277] -SAW
- Fixed XSS security vulnerability in Add/Manage Dashboard page and popup [TPS#15292]-JO
- Fixed privilege escalation in backend scripts ran as root where some included files were editable by nagios user (CVE-2020-15903) (thanks ERNW) -JO
- Fixed command injection vulnerability in report PDF Download (Thanks Christian Weiler) [TPS#15278] -SAW
- Fixed privilege escalation vulnerability in getprofile.sh (Thanks Christian Weiler) [TPS#15279] -SAW
Added
- Added missing scheduled downtime comment data to Host/Service Status Details pages [TPS#15190] -JO
Fixed
- Fixed search on services page to properly search in a case insensitive way [TPS#15241] -JO
- Fixed typo in Admin > Performance Settings max comment history age field [TPS#15227] -JO
- Fixed library path for mrtg2, in cfgmaker. In some OS versions, the path needs to be ../lib64/mrtg2, instead of ../lib/mrtg2 [TPS#15213] -LG
- Fixed library path for mrtg2, in mrtg. In some OS versions, the path needs to be ../lib64/mrtg2, instead of ../lib/mrtg2 [TPS#15213] -LG
- Fixed parameter problem_has_been_acknowledged not working on hoststatus and servicestatus API endpoints [TPS#15256] -JO
- Fixed backup/restore scripts to no longer copy over old nagiosmobile HTTPD config [TPS#15266] -JO
- Fixed issue with the parameter host_object_id (host_id works) not working with objects API calls [TPS#15263] -JO
- Fixed issue with Capacity Planning python script on Ubuntu 20.04 [TPS#15283] -JO
- Fixed Inbound Email Processing when using Outlook and other clients that use Windows line endings [TPS#15285] -JO
- Fixed clearner.php error on systems still running postgresql [TPS#15299] -JO
- Fixed Host/Servicegroup summary dashlets commands link not working while they are inside dashboards [TPS#15196] -JO
- Fixed Host/Service Details pages on smaller screen sizes having the record count/search bar overlap eachother [TPS#15304] -JO
- Fixed issues with Dark Theme Highcharts graphs to be more readable and usable -JO
Component Updates
NDOUtils (NDO) 3.0.3
- Fixed issue with version comparison in database upgrade script
- Fixed issue with failed timed_event brokering on startup
- Fixed issue with erroneous logging of notification brokering failures
- Fixed improper handling of callback registration when some event types were disabled
Security
- Fixed security vulernability with audio import directory allowing php files to be uploaded/ran from that directory (thanks @TactiFail) -JO
- Fixed XSS security vulnerability in background color in Dashboards (thanks @TactiFail) -JO
- Fixed XSS security vulnerability in Config Management > Edit Config page in BPI component (thanks @TactiFail) -JO
- Fixed XSS security vulnerability in Graph Explorer link url option (CVE-2020-15902) (thanks ERNW) -JO
- Fixed RCE vulnerability with ajaxhelper.php when running certain commands through cmdsubsys (CVE-2020-15901) (thanks ERNW) -JO
Fixed
- Fixed NDO issue where renaming hosts and services with uppercase/lowercase letters caused inconsistencies [TPS#15205] -SAW,JO
- Fixed restricting access to auto deploy output JSON files -JO
- Fixed brevity settings for objects/hoststatus and objects/servicestatus when using outputtype=xml -JO
- Fixed issue with NDO connection in Nagios XI using latin1 as default charset instead of utf8 -JO
- Fixed error updating audit log when removing a user [TPS#15172] -JO
- Fixed warning/critical toggle button icon placement on Highcharts graphs with single dataset [TPS#15175] -JO
- Fixed XML brevity causing isseus with Mass Acknowledge and other systems that rely on XML data [TPS#15179] -JO
- Fixed displaying inactive objects that have been disabled in nagios_objects table -JO
- Fixed issue where the “Check for Updates” button on Wizards/Components was not checking latest XI 5.7 versions -JO
- Fixed Top Alert Producers report not showing on CentOS 8 / MySQL 5.7+ [TPS#15202] -JO
- Fixed LDAP integration missing function causing a PHP error when trying to import users from LDAP -JO
- Fixed backend cache causing problems when empty data was returned -JO
- Fixed mod_gearman issue with NDO3 causing it to not use the mod_gearman module -SAW
- Fixed ansible version issue for Auto Deployment component on Ubuntu 16 and Debian 9 systems [TPS#15200] -JO
- Fixed issue with PHP 7 and Scheduling Queue page not showing up properly -JO
- Fixed python setup for Ubuntu 20 systems which have both Python 2 and Python 3 installed -JO
- Fixed NagVis installation issue with Ubuntu 20 and CentOS/RHEL 8 due to using Python 3 -JO
- Fixed Manage Deployed Agents page where OS version would not always update or add when adding new agents [TPS#15192] -JO
Component Updates
NDOUtils (NDO) 3.0.2
- Fixed host/service/contact tables being truncated on restarts (long-standing PENDING states in Nagios XI host/service status)
- Fixed issue with writing contacts to object tables during startup when duplicate objects exist in the nagios configuration
- Fixed issues around NDO trying to broker its own error logs when MySQL was disconnected or disabled
- Fixed issues with NEB callback registration priority for Mod Gearman compatibility
- Fixed issue where changing capitalization of an existing host/service would partially fail
- Improved MySQL reconnection logic to increase chances of successful reconnection and reduce performance impact
- Made previously compile-time debugging configuration available in ndo.cfg
- Added more information to the logs when handling errors during startup
- Added removal of inactive objects from the host/service/contact status tables instead of truncating them completelya
Core Config Manager (CCM) 3.0.6
- Fixed security vulnerability with Static Config Editor allowing editing apache owned files outside static directory (thanks @TactiFail) -JO
Security
- Updated jQuery to version 3.5.1 to fix security vulnerabilities -JO
- Fixed sourceguardian upgrade issue with old versions of XI on 32bit systems -JO
Fixed
- Fixed non-admins not able to process host/service relations from the db causing the user to see no hosts/services -JO
- Fixed issue with State History report causing a PHP error and would not display state data -JO
- Fixed installation issue on RHEL 8 with redhat-lsb-core package installed -JO
- Fixed resolving hostname in IP Mismatch popup check for systems with hostnames in the program URL -JO
- Fixed styling issues on Configure main page when using Modern Dark theme -JO
- Fixed the ndo2db manage_services.sh script status check to return a message since ndo2db was removed -JO
- Fixed object status retries in the Performance Settings page not saving when set -JO
- Fixed restore snapshot in CCM broker_module being overwritten with ndo2 version of broker module line -JO
Component Updates
NDOUtils (NDO) 3.0.1
- Fixed failure on startup due to oversized subqueries in ndo_write_contact_objects, ndo_write_services_objects, and ndo_write_hosts_objects
- Fixed errors when re-running the upgrade script for 2.1.3->3.0.x
- Fixed “name1 is null” error messages during startup due to missing timeperiods.
Security
- Updated SourceGuardian loaders to now support PHP versions up to 7.4 -JO
- Updated access methods for subsystems that needed random credentials and removed the Admin > “Security Credentials” page -JO
Updated
- Updated NRDP to version 2.0.3 -JO
- Updated NRPE to version 4.0.3 -JO
- Updated Nagios Plugins to version 2.3.3 -JO
- Updated objects API to no longer convert XML to JSON for a more consistent output and always returns the same structure at any result size [TPS#14740] -JO
- Updated Bulk Modifications Tool to allow only setting certain arguments selected by checkboxes [TPS#14765] -JO
- Updated layout on host/service status pages to maximize space and allow removing summary dashlets via page config settings -JO
- Updated Hostgroup and Servicegroup command buttons to use popups instead of going to old Core proxy pages -JO
- Updated restore_xi.sh script to ask for MySQL password when running if it cannot connect to MySQL [TPS#14294] -JO
- Updated layout for LDAP/AD import user selection page to make more usable when selecting many users -JO
- Updated Exchange config wizards to use NCPA instead of NSClient++ -LG,JO
- Updated Windows Server/Desktop to use NCPA instead of NSClient++ -JO
- Updated Legacy NSClient++ configuration wizard (used to be Windows Server/Desktop) -JO
- Updated Availability report to increase speed by reducing the amount of data parsed when filtering -JO
- Fixed Unconfigured Objects auto-configure templates to use ID to not cause config errors if template is deleted [TPS#14328] -JO
- Fixed backend API using insecure login ticket (backend API is deprecated and will be removed in XI 6) [TPS#15087] -JO
Added
- Added new Nagios Mobile interface that better integrates with Nagios XI -CN,SAW
- Added support for CentOS/RHEL/Oracle 8 -JO
- Added support for Ubuntu 20.04 LTS and Debian 10 -JO
- Added NCPA agent deployment and updated NCPA config wizard -JO
- Added notice to the login alert box that mentions if hostname or ip is valid in program url [TPS#2327] -JO
- Added add and remove servicegroups to and from services in Bulk Modifications Tool [TPS#13587] -CN
- Added ability to play sounds when state changes occur in the NOC screen [TPS#10777] -SAW
- Added Audit Log messages for REST API calls [TPS#6913] -SAW
- Added configuration options to send the Audit Log to Nagios Log Server [TPS#13942] -SAW
- Added ability to set Dashboard backgrounds to transparent [TPS#14284] -JO
- Added Config Management section to Nagios BPI component [TPS#14473] -JO
- Added search box into LDAP/AD import page to decrease amount of users displayed and to find specific users [TPS#10230] -JO
- Added new JSON configuration wizard -JO
- Added new XML configuration wizard -JO
Fixed
- Fixed issue with LDAP/AD select users toggle all/none checkbox not working properly -JO
- Fixed limited LDAP/AD queries (PHP 5.3.x will require a search but will notify when limit is reached) [TPS#10230] -JO
- Fixed resizing issue when updating dashlets in Capacity Planning tab in the host/service status details pages [TPS#15053] -JO
- Fixed custom time range on SLA report to use proper time range specified [TPS#15048] -JO
- Fixed issues with old RRDtool graphs not displaying properly in Performance Graph page [TPS#15076] -JO
- Fixed certain NCPA checks running through test command causing wrong output -JO
- Fixed CCM page in use message not clearing when on apply config page if they are expired [TPS#15163] -JO
Security
- Fixed postauth RCE issue with CCM test command function in command_test.php (X-Force 179405) -JO
- Fixed postauth RCE issue in RRD exporting script export-rrd.php (X-Force 179404) -JO
- Fixed issues with order by on SNMP Trap Interface SQL injections with a whitelist (X-Force 179406) -JO
Updated
- Fixed installation issue with SUSE Extended Support for RHEL systems (Thanks Derek) -JO
Fixed
- Fixed issue with CORS policy for API endpoints -JO
- Fixed input filter text box in schedule host downtime page and CCM not working in Chrome [TPS#15073] -JO,SAW
Security
- Fixed post auth XSS vulnerabilities (CVE-2020-10819, CVE-2020-10820, CVE-2020-10821) -JO
- Fixed security issues with Highcharts SVG generation -JO
- Fixed RCE vulnerability in admin section’s NRDP/NSCA outbound check configuration (thanks @TactiFail) -JO
Fixed
- Fixed minor usability issues with SNMP Trap Interface -SAW
Fixed
- Fixed issue with backups not properly generating due to tar creation errors -JO
Security
- Fixed unauthenticated XSS/SSRF in highcharts local exporting tool -SAW
Fixed
- Fixed LDAP/AD integration CA certificate upload to allow both root and intermediate on same subject [TPS#14855] -JO
- Fixed Bulk Modifications Tool add/remove free variables not setting last_modified value causing changes not to be written [TPS#14875] -JO
- Fixed BPI removing host/services out of the groups when they are renamed [TPS#14929] -JO
- Fixed unauthenticated username disclosure in suggest.php -SAW
Security
- Fixed RCE vulnerability with apache user code execution in Scheduled Reporting component (CVE-2019-20197) -JO
- Fixed XSS vulnerability in Scheduled Reporting component and nocscreen (nocscreen can be upgraded from Admin > Manage Components) (CVE-2019-20139) -JO
- Fixed login redirection to remove double slashes as part of redirection security parsing -JO
Component Updates
Core Config Manager (CCM) 3.0.5
- Fixed several issues with importing service dependencies [TPS#14737] -SAW
Fixed
- Fixed CSS styling for host/service status tables in IE when using the dark theme [TPS#14653] -JO
- Fixed issue in config/service API call that would not set free variables on already existing services [TPS#14660] -JO
- Fixed service notes not showing in the Misc Info section of the Service Details page [TPS#14679] -JO
- Fixed issue in AD/LDAP certificate management where certificates with binary data couldn’t be added [TPS#14690] -JO
- Fixed the ndo preloading functions only searching for is_active=1 potentially causing duplicate objects on large systems -JO
- Fixed issue with service/host filters not properly aligned on top of the table when hidedashlets=1 is set [TPS#14699] -JO
- Fixed issue where Running “last week” report on first day of week gives wrong weeks data [TPS#14722] -SW
- Fixed issue with search bar location when hideoptions is set [TPS#14735] -JO
Component Updates
Core Config Manager (CCM) 3.0.4
- Fixed issue with CCM config imports that would delete all free variables when importing leaving only new ones -JO
- Fixed form validation for object names and service descriptions to match the default illegal_object_name_chars directive in nagios.cfg -SAW
Security
- Updated SourceGuardian loaders to now support PHP versions up to 7.3 -JO
- Updated jQuery to 3.4.1 and patched jQuery 1.12.4 for CVE-2019-11358 -JO
- Fixed multiple security vulnerabilities that allowed nagios user command injections (thanks Jeremy Brown) -JO
Updated
- Updated the getprofile.sh script to add the BPI configurations to the profile.zip -JO
Fixed
- Fixed issue on SLA report where advanced options were not properly applying [TPS#14538] -JO
- Fixed threshold/range function in check_rrdtraf plugin -CD,JO
- Fixed issue with BPI sync checkbox being required when checking remove host/services that are missing on apply config [TPS#14590] -JO
- Fixed negative numbers in Capacity Planning report and wizard -SAW
- Fixed issue with overwriting user meta data on each page load causing LDAP/AD import blank screen for LDAP/AD users [TPS#14636] -JO
- Fixed issue with BPI configuration comments and hash tags in hostgroup/servicegroup names -JO
- Fixed issue where deleting multiple services from a host would cause only one to delete at a time during BPI sync [TPS#14649] -JO
Added
- Added IBM i service and custom sql config wizards on new installs -JO
Fixed
- Fixed objects/bpi REST API output to properly display status text when there is HTML in the text [TPS#14406] -JO
- Fixed issue with SNMPv3 checks using Perl on Ubuntu 18 systems [TPS#14432] -JO
- Fixed problem where you cannot import time periods where timeperiod_name contains space [TPS#14440] -SW
- Fixed logrotate configuration to set the user/group for xidebug.log and fix for snmptt log rotation -SW
- Fixed issue with & used in BPI group name and when running plugin against that group [TPS#14464] -JO
- Fixed issue where clearing and empty unconfigured objects list when there was no objects file would cause permissions issues on the file [TPS#14469] -JO
- Fixed scheduled reporting for latest NagVis component so that scheduled pages can be sent as PDFs [TPS#14428] -JO
- Fixed auth token and insecure auth token sessions to properly load user meta session data directly after login -JO
- Fixed issue on EL7 systems where some output displayed by systemctl status during sysstat checks caused PHP XML parse warnings [TPS#14498] -JO
Security
- Fixed XSS and privilege escalation security vulnerability in Profile component and getprofile.sh script (CVE-2019-15949) (Thanks Jak Gibb) [TPS#14364] -JO
Fixed
- Fixed issue where re-configuring objects page would not allow switching them back to notify immediately [TPS#14340] -JO
- Fixed issue where Graph Explorer exporting would be broken after upgrades [TPS#14372] -SAW
- Fixed BPI api_tool.php NDO wait timeout to allow for longer NDO startup times [TPS#14398] -JO
- Fixed issue with dashlets that have been uploaded unable to be downloaded due to file permissions in tmp directory [TPS#14363] -JO
- Fixed CCM form validation to allow backslashes in object names/service descriptions -SAW
- Fixed MIB uploading/processing on Postgres-based systems [TPS#14365] -SAW
- Fixed API DELETE methods not allowing URL path to be used like in the help section [TPS#14370] -JO
- Fixed Bulk Modifications Tool find relationship listings to be sorted alphabetically [TPS#12156] -JO
- Fixed logrotate configuration to set the user/group on systems except el6 which doesn’t require it -JO
- Fixed issue with Recurring Scheduled Downtime not showing when services is set to only the * wildcard [TPS#14388] -JO
- Fixed Nagios XI Bug Report: Config Wizard Template Notification Interval could not be set to 0 [TPS#14391] -SW
- Fixed problem with reading multiple line hashes sent when an inbound email response is wrapped [TPS#14396] -JO
- Fixed issue in Schedule Downtime page when deleting host/service group from list and it saying none are selected [TPS#14402] -JO
Full changelog as Markdown
