Werk #16234: Hide credentials in ps output for mk_oracle

Component	Checks & agents
Title	Hide credentials in ps output for mk_oracle
Date	Feb 20, 2024
Level	Trivial Change
Class	Security Fix
Compatibility	Compatible - no manual interaction needed
Checkmk versions & editions	2.4.0b1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME) 2.3.0b4 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME) 2.2.0p24 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME) 2.1.0p41 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

In the mk_oracle plugin sqlplus used to be called with the connection string as an argument. This connection string could contain credentials necessary to authenticate against the database. These arguments could be extracted by other users (e.g. with use of ps).

This vulnerability was reported to us, we are not aware of any exploitations.

Affected Versions:

2.2.0 2.1.0 2.0.0 (probably older versions as well)

Vulnerability Management:

We have rated the issue with a CVSS Score of 3.8 (Low) with the following CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. We assigned CVE-2024-1742 to this vulnerability.

Changes: With this Werk the connection string is now piped via stdin to sqlplus.

To the list of all Werks