CVE-2023-3218 (published 2023-06-13T11:15Z)

Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.

CVSS v3 base score: 4.4, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-366
cwe_name: Race Condition within a Thread
description: If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
extended_description: 
            
             
			 
         
         

Fix information:
repo_url: https://github.com/it-novum/openitcockpit
commit_details: repo_url: https://github.com/it-novum/openitcockpit
author: nook24
author_date: 2023-06-06 16:07:29+02:00
msg: ITC-3014 Add unique index to MySQL tables to avoid race condition #1517
repository: repo_url: https://github.com/it-novum/openitcockpit
repo_name: it-novum/openITCOCKPIT
description: openITCOCKPIT is an Open Source system monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus.
repo_language: PHP
owner: it-novum
file_changes: filename: 20230606131052_UniqueIndexForIsUnique.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,90 @@
+<?php
+// Copyright (C) <2015>  <it-novum GmbH>
+//
+// This file is dual licensed
+//
+// 1.
+//  This program is free software: you can redistribute it and/or modify
+//  it under the terms of the GNU General Public License as published by
+//  the Free Software Foundation, version 3 of the License.
+//
+//  This program is distributed in the hope that it will be useful,
+//  but WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//  GNU General Public License for more details.
+//
+//  You should have received a copy of the GNU General Public License
+//  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+// 2.
+//  If you purchased an openITCOCKPIT Enterprise Edition you can use this file
+//  under the terms of the openITCOCKPIT Enterprise Edition license agreement.
+//  License agreement and license key will be shipped with the order
+//  confirmation.
+
+declare(strict_types=1);
+
+use Migrations\AbstractMigration;
+
+/**
+ * Class UniqueIndexForIsUnique
+ *
+ * Created via:
+ * oitc migrations create UniqueIndexForIsUnique
+ *
+ * Run migration:
+ * oitc migrations migrate
+ *
+ */
+class UniqueIndexForIsUnique extends AbstractMigration {
+    /**
+     * Change Method.
+     *
+     * More information on this method is available here:
+     * https://book.cakephp.org/phinx/0/en/migrations.html#the-change-method
+     * @return void
+     */
+    public function change(): void {
+
+        if ($this->hasTable('agentchecks')) {
+            $this->table('agentchecks')
+                ->addIndex(
+                    [
+                        'name',
+                    ],
+                    ['unique' => true]
+                )
+                ->update();
+        }
+
+        if ($this->hasTable('macros')) {
+            $this->table('macros')
+                ->addIndex(
+                    [
+                        'name',
+                    ],
+                    ['unique' => true]
+                )
+                ->update();
+        }
+
+        if ($this->hasTable('users')) {
+            $this->table('users')
+                ->addIndex(
+                    [
+                        'email',
+                    ],
+                    ['unique' => true]
+                )
+                ->addIndex(
+                    [
+                        'email',
+                        'ldap_dn'
+                    ],
+                    ['unique' => true]
+                )
+                ->update();
+        }
+
+    }
+}

programming_language: PHP
filename: 20230606131738_UniqueIndexForIsUnique.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,60 @@
+<?php
+// Copyright (C) <2015>  <it-novum GmbH>
+//
+// This file is dual licensed
+//
+// 1.
+//	This program is free software: you can redistribute it and/or modify
+//	it under the terms of the GNU General Public License as published by
+//	the Free Software Foundation, version 3 of the License.
+//
+//	This program is distributed in the hope that it will be useful,
+//	but WITHOUT ANY WARRANTY; without even the implied warranty of
+//	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//	GNU General Public License for more details.
+//
+//	You should have received a copy of the GNU General Public License
+//	along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+
+// 2.
+//	If you purchased an openITCOCKPIT Enterprise Edition you can use this file
+//	under the terms of the openITCOCKPIT Enterprise Edition license agreement.
+//	License agreement and license key will be shipped with the order
+//	confirmation.
+
+declare(strict_types=1);
+
+use Migrations\AbstractMigration;
+
+/**
+ * Class UniqueIndexForIsUnique
+ *
+ * Created via:
+ * oitc migrations create -p GrafanaModule UniqueIndexForIsUnique
+ *
+ * Run migration:
+ * oitc migrations migrate -p GrafanaModule
+ *
+ */
+class UniqueIndexForIsUnique extends AbstractMigration {
+    /**
+     * Change Method.
+     *
+     * More information on this method is available here:
+     * https://book.cakephp.org/phinx/0/en/migrations.html#the-change-method
+     * @return void
+     */
+    public function change(): void {
+        if ($this->hasTable('grafana_userdashboards')) {
+            $this->table('grafana_userdashboards')
+                ->addIndex(
+                    [
+                        'name',
+                    ],
+                    ['unique' => true]
+                )
+                ->update();
+        }
+    }
+}

programming_language: PHP