CVS commit: pkgsrc/net/icinga2

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Aug 18 18:49:48 UTC 2026

Modified Files:
        pkgsrc/net/icinga2: Makefile distinfo

Log Message:
icinga2: updated to 2.16.5

2.16.5 (2026-08-18)

This release contains a bugfix for a regression in the `IcingaDB` feature that was introduced in v2.16.0 and some
security enhancements that fix a couple of minor vulnerabilities.

One vulnerability allowed an authenticated `ApiUser` with the `events/*` permission to obtain information about
objects through crafted filter expressions, without holding the relevant `objects/query/*` permission. The fix is to
correctly apply permissions to filter expressions on `/v1/events`.

The other vulnerability allowed an authenticated Icinga 2 node to use the ~1 GB message limit to possibly crash another
node through memory exhaustion. Depending on available memory, multiple compromised nodes may be required for
a successful attack since a node can only make one connection. The fix applies a 16 MiB limit to messages from nodes
lower in the hierarchy.

Security Enhancements

* Apply user permissions to filter expressions for `/v1/events` similarly to `/v1/objects`
  ([GHSA-v265-w3gm-99vg](https://github.com/Icinga/icinga2/security/advisories/GHSA-v265-w3gm-99vg))
* Introduce an additional 16 MiB message size limit on all child-zone connections
  ([GHSA-wm63-p2jg-5665](https://github.com/Icinga/icinga2/security/advisories/GHSA-wm63-p2jg-5665))
* Don't include sensitive certificate request tickets in log messages
* Don't log full object config containing potentially sensitive information

Bugfixes

* IcingaDB: Fix multiple potential race conditions during initial config dump


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 pkgsrc/net/icinga2/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/net/icinga2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/icinga2/Makefile
diff -u pkgsrc/net/icinga2/Makefile:1.30 pkgsrc/net/icinga2/Makefile:1.31
--- pkgsrc/net/icinga2/Makefile:1.30    Tue Jul 21 10:31:32 2026
+++ pkgsrc/net/icinga2/Makefile Tue Aug 18 18:49:48 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.30 2026/07/21 10:31:32 adam Exp $
+# $NetBSD: Makefile,v 1.31 2026/08/18 18:49:48 adam Exp $
 
-DISTNAME=      icinga2-2.16.4
+DISTNAME=      icinga2-2.16.5
 CATEGORIES=    net sysutils
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=icinga/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/net/icinga2/distinfo
diff -u pkgsrc/net/icinga2/distinfo:1.15 pkgsrc/net/icinga2/distinfo:1.16
--- pkgsrc/net/icinga2/distinfo:1.15    Tue Jul 21 10:31:32 2026
+++ pkgsrc/net/icinga2/distinfo Tue Aug 18 18:49:48 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.15 2026/07/21 10:31:32 adam Exp $
+$NetBSD: distinfo,v 1.16 2026/08/18 18:49:48 adam Exp $
 
-BLAKE2s (icinga2-2.16.4.tar.gz) = a422fa560a3a51cd40a37a673af93cb8ed2fea25c2db2aa937b395cb504f9d4d
-SHA512 (icinga2-2.16.4.tar.gz) = 90ec50b7f6438e7b7ae04a370c514ed005e3068cef5df5f2fa5ea502d14654287eb18ec4c360a6bccade88dee68b20b2a04c4cd2a6fedfd3548a7ba94996a3b7
-Size (icinga2-2.16.4.tar.gz) = 9585593 bytes
+BLAKE2s (icinga2-2.16.5.tar.gz) = c8ae584668daa535b2a0577596211ac88f28b312203a8cdab761684f913523bf
+SHA512 (icinga2-2.16.5.tar.gz) = 253d32c793670eea9f48cc72d1ec7c7aaafa287fbea3f0aec888add5f7229bfd6b10678f9944392fca9a40af2109e8fcb04fcaee682f7ce0cdbddfef4e802571
+Size (icinga2-2.16.5.tar.gz) = 9587332 bytes
 SHA1 (patch-third-party_cmake_FindMySQL.cmake) = a33567c30db47c4fab379f1b7c358174dd85fdd3