Ubuntu Security Notices
USN-4860-1

USN-4860-1: Monit vulnerabilities

Publication date

15 March 2021

Overview

Several security issues were fixed in Monit.

Releases

18.04 LTS 16.04 LTS 14.04 LTS

Packages

monit - utility for monitoring and managing daemons or similar programs

Details

Zack Flack discovered that Monit incorrectly handled certain input. A
remote authenticated user could exploit this to conduct cross-site
scripting (XSS) attacks. (CVE-2019-11454)

Zack Flack discovered a buffer overread when Monit decoded certain crafted
URLs. An attacker could exploit this to potentially leak sensitive
information. (CVE-2019-11455)

Zack Flack discovered that Monit incorrectly handled certain input. A
remote authenticated user could exploit this to conduct cross-site
scripting (XSS) attacks. (CVE-2019-11454)

Zack Flack discovered a buffer overread when Monit decoded certain crafted
URLs. An attacker could exploit this to potentially leak sensitive
information. (CVE-2019-11455)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
18.04 bionic	monit – 1:5.25.1-1ubuntu0.1~esm1
16.04 xenial	monit – 1:5.16-2ubuntu0.2+esm1
14.04 trusty	monit – 1:5.6-2ubuntu0.1+esm2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

USN-3971-1

USN-3971-1