openSUSE-SU-2021:0706-1 Security update for monitoring-plugins-smart
Not scored
Published
Check this codebase for openSUSE-SU-2021:0706-1 and fix it if it is affected.
What it is: openSUSE-SU-2021:0706-1 is a vulnerability in monitoring-plugins-smart, published on 10 May 2021.
Exploitation: There is no known exploitation of openSUSE-SU-2021:0706-1 in the wild and no public exploit code.
Affected product: monitoring-plugins-smart. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/openSUSE-SU-2021-0706-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2021-0706-1/index.md)
An update to monitoring-plugins-smart fixes a regular expression issue for pseudo-devices, potentially preventing incorrect device identification or monitoring failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is openSUSE-SU-2021:0706-1?
openSUSE-SU-2021:0706-1 is a vulnerability in monitoring-plugins-smart, published on 10 May 2021.
Official description
This update for monitoring-plugins-smart fixes the following issues:
monitoring-plugins-smart was updated to 6.9.1:
This is a security-release (boo#1183057)
- Fixes the regular expression for pseudo-devices under the /dev/bus/N path. from 6.9.0
- Allows using PCI device paths as device name(s) (#64)
- Introduce new optional parameter -l/–ssd-lifetime) which additionally checks SMART attribute 'Percent_Lifetime_Remain' (available on some SSD drives). (#66 #67) from 6.8.0
- Allow skip self-assessment check (–skip-self-assessment)
- Add Command_Timeout to default raw list from 6.7.1
- Bugfix to make –warn work (issue #54) from 6.7.0
- Added support for NVMe drives from 6.6.1
- Fix 'deprecation warning on regex with curly brackets' (6.6.1) from 6.6.0
- The feature was requested in #30 . This PR adds the possibility to use 3ware,N and cciss,N drives in combination with the global -g parameter.
- Furthermore this PR adjusts the output of the plugin when the -g is used in combination with hardware raid controllers. Instead of showing the logical device name (/dev/sda for example), the plugin will now show the controller with drive number from 6.5.0:
- Add Reported_Uncorrect and Reallocated_Event_Count to default raw list.
- As of 6.5 the following SMART attributes are by default checked and may result in alert when threshold (default 0 is reached): 'Current_Pending_Sector,Reallocated_Sector_Ct,Program_Fail_Cnt_Total, Uncorrectable_Error_Cnt,Offline_Uncorrectable,Runtime_Bad_Block, Reported_Uncorrect,Reallocated_Event_Count'
Update to version 6.4
- Allow detection of more than 26 devices / issue #5 (rev 5.3)
- Different ATA vs. SCSI lookup (rev 5.4)
- Allow script to run outside of nagios plugins dir / wiki url update (rev 5.5)
- Change syntax of -g parameter (regex is now awaited from input) (rev 5.6)
- Fix Use of uninitialized value $device (rev 5.7)
- Allow multiple devices for interface type megaraid, e.g. 'megaraid,[1-5]' (rev 5.8)
- allow type 'auto' (rev 5.9)
- Check selftest log for errors using new parameter -s (rev 5.10)
- Add exclude list (-e) to ignore certain attributes (5.11)
- Fix 'Use of uninitialized value' warnings (5.11.1)
- Add raw check list (-r) and warning thresholds (-w) (6.0)
- Allow using pseudo bus device /dev/bus/N (6.1)
- Add device model and serial number in output (6.2)
- Allow exclusion from perfdata as well (-E) and by attribute number (6.3)
- Remove dependency on utils.pm, add quiet parameter (6.4)
Drop not longer needed patch:
- enable_auto_interface.patch (obsolete, type auto was added upstream in v5.9).
Which versions are affected by openSUSE-SU-2021:0706-1?
Linux distribution packages (3)
monitoring-plugins-smart SUSE:Package Hub 15 SP1 | All versions | 6.9.1-bp152.4.3.1 |
monitoring-plugins-smart SUSE:Package Hub 15 SP2 | All versions | 6.9.1-bp152.4.3.1 |
monitoring-plugins-smart openSUSE:Leap 15.2 | All versions | 6.9.1-bp152.4.3.1 |
How do I fix openSUSE-SU-2021:0706-1?
Upgrade to a fixed version.
Is openSUSE-SU-2021:0706-1 being exploited?
There is no known exploitation of openSUSE-SU-2021:0706-1 in the wild and no public exploit code.