Critical Crash Vulnerability in Zabbix Webdriver Component
Summary
DEBIAN-CVE-2024-42329: The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. Affects zabbix versions < 1:7.0.5+dfsg-1. Fixed in 1:7.0.5+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zabbix is an open-source monitoring software tool for networks and applications. It provides monitoring metrics, alerting, and visualization capabilities. The software is widely used for its ability to monitor various services, servers, and network hardware. However, a vulnerability has been identified in the webdriver component of Zabbix, which can lead to application crashes under certain conditions.
Vulnerability Detail
The vulnerability arises from the webdriver for the Browser object, which expects an error object to be initialized when the webdriver_session_query function fails. If the function fails for reasons that do not provide an error description, the wd->error will be NULL. Attempting to read from this NULL error object can lead to a crash of the application. This issue can disrupt monitoring services and lead to downtime, impacting users relying on Zabbix for critical monitoring tasks.
How To Fix
Minimum fixed version
1:7.0.5+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zabbixTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Zabbix package.
Conclusion
The identified vulnerability in the Zabbix webdriver component poses a significant risk of application crashes due to uninitialized error objects. Users are strongly encouraged to update to the patched version to ensure stability and reliability in their monitoring services.
See every vulnerability recorded for zabbix →
FAQ
The vulnerability is a crash issue in the webdriver component that occurs when an error object is not properly initialized, leading to potential application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If left unaddressed, this vulnerability can lead to application crashes, resulting in downtime and loss of monitoring capabilities for critical systems.
Yes, versions prior to 1:7.0.5+dfsg-1 are vulnerable to this issue. It is recommended to upgrade to this version or later.
While there are no specific workarounds, it is advisable to monitor the application closely and plan for an update as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for zabbix.
