# openSUSE-SU-2021:0706-1: Security update for monitoring-plugins-smart

> An update to monitoring-plugins-smart fixes a regular expression issue for pseudo-devices, potentially preventing incorrect device identification or monitoring failures.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 May 2021

## What is openSUSE-SU-2021:0706-1?

openSUSE-SU-2021:0706-1 is a vulnerability in monitoring-plugins-smart, published on 10 May 2021. 

### Official description

This update for monitoring-plugins-smart fixes the following issues:

monitoring-plugins-smart was updated to 6.9.1:

  This is a security-release (boo#1183057)
  + Fixes the regular expression for pseudo-devices under the /dev/bus/N path.
  from 6.9.0
  + Allows using PCI device paths as device name(s) (#64)
  + Introduce new optional parameter -l/--ssd-lifetime) which additionally 
    checks SMART attribute 'Percent_Lifetime_Remain' 
    (available on some SSD drives). (#66 #67)
  from 6.8.0
  + Allow skip self-assessment check (--skip-self-assessment)
  + Add Command_Timeout to default raw list
  from 6.7.1
  + Bugfix to make --warn work (issue #54)
  from 6.7.0
  + Added support for NVMe drives
  from 6.6.1
  + Fix 'deprecation warning on regex with curly brackets' (6.6.1)
  from 6.6.0
  + The feature was requested in #30 . This PR adds the possibility to
    use 3ware,N and cciss,N drives in combination with the 
    global -g parameter.
  + Furthermore this PR adjusts the output of the plugin when the -g 
    is used in combination with hardware raid controllers. Instead of
    showing the logical device name (/dev/sda for example), the plugin
    will now show the controller with drive number
  from 6.5.0:
  + Add Reported_Uncorrect and Reallocated_Event_Count to default raw list.
  + As of 6.5 the following SMART attributes are by default checked and 
    may result in alert when threshold (default 0 is reached):
    'Current_Pending_Sector,Reallocated_Sector_Ct,Program_Fail_Cnt_Total,
     Uncorrectable_Error_Cnt,Offline_Uncorrectable,Runtime_Bad_Block,
     Reported_Uncorrect,Reallocated_Event_Count'

- Update to version 6.4

  - Allow detection of more than 26 devices / issue #5 (rev 5.3)
  - Different ATA vs. SCSI lookup (rev 5.4)
  - Allow script to run outside of nagios plugins dir / wiki url
    update (rev 5.5)
  - Change syntax of -g parameter (regex is now awaited from
    input) (rev 5.6)
  - Fix Use of uninitialized value $device (rev 5.7)
  - Allow multiple devices for interface type megaraid,
    e.g. 'megaraid,[1-5]' (rev 5.8)
  - allow type 'auto' (rev 5.9)
  - Check selftest log for errors using new parameter -s (rev 5.10)
  - Add exclude list (-e) to ignore certain attributes (5.11)
  - Fix 'Use of uninitialized value' warnings (5.11.1)
  - Add raw check list (-r) and warning thresholds (-w) (6.0)
  - Allow using pseudo bus device /dev/bus/N (6.1)
  - Add device model and serial number in output (6.2)
  - Allow exclusion from perfdata as well (-E) and by attribute
    number (6.3)
  - Remove dependency on utils.pm, add quiet parameter (6.4)
- Drop not longer needed patch:
  * enable_auto_interface.patch (obsolete, type auto was added
    upstream in v5.9).

## Which versions are affected by openSUSE-SU-2021:0706-1?


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `monitoring-plugins-smart` | SUSE:Package Hub 15 SP1 | All versions | 6.9.1-bp152.4.3.1 |
| `monitoring-plugins-smart` | SUSE:Package Hub 15 SP2 | All versions | 6.9.1-bp152.4.3.1 |
| `monitoring-plugins-smart` | openSUSE:Leap 15.2 | All versions | 6.9.1-bp152.4.3.1 |

## How do I fix openSUSE-SU-2021:0706-1?

Upgrade to a fixed version.

## Is openSUSE-SU-2021:0706-1 being exploited?

There is no known exploitation of openSUSE-SU-2021:0706-1 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for openSUSE-SU-2021:0706-1 and fix it if it is affected.

What it is: openSUSE-SU-2021:0706-1 is a vulnerability in monitoring-plugins-smart, published on 10 May 2021. 
Exploitation: There is no known exploitation of openSUSE-SU-2021:0706-1 in the wild and no public exploit code.

Affected product: monitoring-plugins-smart. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/openSUSE-SU-2021-0706-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2021-0706-1/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/openSUSE-SU-2021:0706-1

---
From sbomify Insights: https://insights.sbomify.com/openSUSE-SU-2021-0706-1/
Summaries are generated and may contain mistakes; the official description above is the record.