Werk #17148: Persist known host keys for checks that use SSH

Component	Checks & agents
Title	Persist known host keys for checks that use SSH
Date	Aug 26, 2024
Level	Trivial Change
Class	Security Fix
Compatibility	Compatible - no manual interaction needed
Checkmk versions & editions	2.4.0b1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME) 2.3.0p15 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME) 2.2.0p33 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME) 2.1.0p48 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

When using the special agent VNX quotas and filesystems or the active check Check SFTP Service the host keys were not properly checked.

If an attacker would get into a machine-in-the-middle position he could intercept the connection and retrieve information e.g. passwords.

As of this Werk the host key check is properly done. In order to store known host keys a regular known_hosts file is used that is stored in /omd/sites/$SITENAME/.ssh/known_hosts. If a host key changes an error is now raised that requires manual edit of this file.

This issue was found during internal review.

Affected Versions:

• 2.3.0
• 2.2.0
• 2.1.0
• 2.0.0 (EOL)

Vulnerability Management:

We have rated the issue with a CVSS Score of 6.3 Medium CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N and assigned CVE-2024-6572.

To the list of all Werks