Update Info

openSUSE-2025-473


Security update for icinga-php-library, icingaweb2


Type: security
Severity: moderate
Issued: 2025-12-18
Description:
This update for icinga-php-library, icingaweb2 fixes the following issues:

Changes in icingaweb2:
- Update to 2.12.6
  - Search box shows many magnifying glasses for some community themes #5395
  - Authentication hooks are not called with external backends #5415
  - Improve Minimal layout #5386

- Update to 2.12.5
  * PHP 8.4 Support
    We're again a little behind schedule, but now we support PHP 8.4!
    This means that installations on Ubuntu 25.04 and Fedora 42+ can
    now install Icinga Web without worrying about PHP related
    incompatibilities. Icinga packages will be available in the
    next few days.
  * Good Things Take Time
    There's only a single (notable) recent issue that is fixed
    with this release. All the others are a bit older.
    - External URLs set up as dashlets are not embedded the same
      as navigation items #5346
  * But the team sat together a few weeks ago and fixed a bug here
    and there. And of course, also in Icinga Web!
    - Users who are not allowed to change the theme, cannot change
      the theme mode either #5385
    - Improved compatibility with several SSO authentication
      providers #5000, #5227
    - Filtering for older-than events with relative time does not
      work #5263
    - Empty values are NULL in CSV exports #5350
  * Breaking, Somewhat
    This is mainly for developers.
    With the support of PHP 8.4, we introduced a new environment
    variable, ICINGAWEB_ENVIRONMENT. Unless set to dev, Icinga Web
    will not show nor log deprecation notices anymore.

- Update to 2.12.4
  - Database login broken after upgrade #5343

- Update to 2.12.3
  - XSS in embedded content CVE-2025-27405
  - DOM-based XSS CVE-2025-27404
  - Open redirect on login page CVE-2025-30164
  - Reflected XSS CVE-2025-27609
  - Login against Postgres DB is case-sensitive #5223
  - Role list has no functioning quick search #5300
  - After clicking on Check now, the page does not refresh itself #5293
  - Service States display wrong since update to 2.12.2 #5290

- Set right version for icinga-php-library.

- Fix usage of %requires_eq: invalid syntax previosly resulted in
  ignored lines and now properly returns an error.

- Update to 2.12.2
  - Sort by name of roles does not work properly #4789
  - Settings menu flyout closes too fast / easy #5196
  - CSP header is missing the script-src policy #5180
  - Broken event overview due to IntlDateFormatter #5172
  - Downtimes, which were started and canceled, are missing in the history #5176
  - Usage of IcingaWeb2 api command returns 404, but is successful #5183
  - Allow fontawesome icons as menu items #5205
  - Error while opening a navigation root item #5177
  - Dashlets twice in dashboard & not deletable #5203
  - PluginOutputRenderer gets called twice #5271
  - Graphs disappear after form controls are used #4996
  - Make subgroups of custom variables fully collapsible #5256

- Provide group as required by RPM 4.19 

- Update to 2.12.1
  - Add PHP 8.3 support
  - Login Redirect Loop #5133
  - UI database migration not fully compatible with PostgreSQL #5129
  - Missing styles when logging out and in while CSP is enabled #5126

- Update to 2.12.0
  - Support for PHP 8.2 #4918
  - Support for Content-Security-Policy #4528
  - Allow to initiate a refresh with __REFRESH__ #5108
  - Don't refresh twice upon __CLOSE__ #5106
  - Add event column-moved #5049
  - Add copy-to-clipboard behavior #5041
  - Access Oracle Database via tnsnames.ora / LDAP Naming Services #5062
  - Reduce risk of crashing the x509 collector daemon #5115
  - CSV export does not escape double quotes #4910
  * Full changelog see:
    https://github.com/Icinga/icingaweb2/milestone/79?closed=1
- Massive changes in spec needed.

- DB schema files are in schema not etc/schema in packaged tarball 

- Add subpackge php-fpm with php-fpm configuration.
- Remove max php version restrictions for suse.
- Fix rights for /etc/icingaweb2/enabledModules directory 
  as upstream use.

Changes in icinga-php-library:
- Update to 1.17.0
  - No changelog from upstream.

- Update ot 0.14.1
  - No changelog from upstream.

- Remove unneded requires and buildrequires icinga-php-common.
- Add missing requires.

- Update to 0.13.0
  - No changelog from upstream.

- Update to 0.12.0
  - No changelog from upstream.

- Update to 0.11.0
  - No changelog from upstream.


              

Packages


  • icinga-php-library-0.17.0-bp157.2.3.1
  • icingaweb2-2.12.6-bp157.2.3.1