Released 2021-12-01
Linux SHA256 - 4e4b7b4939112dd698e8def9dfacfecd3d73772c641c2204f82102db2ba64484
Linux MD5 - 544c9521f6c629e171090ea49e45ea9f
This release of Open-AudIT was bought forward because of the disclosure of two vulnerabilities.
This release fixes these issues.
The details of each can be found at:
- Errata - 4.2.0 and earlier Javascript vulnerability
- Errata - 4.2.0, 3.5.0 and onwards util function vulnerability
| Version | Type | Collection | Description |
|---|---|---|---|
| Professional | Bug | Integrations | When multiple integrations are configured, multiple identical attributes would appear in the integrations details on the device details page. |
| Professional | New Feature | Discoveries | Retrieve and display installed certificates on Linux. Both system wide and Apache specific. |
| Professional | New Feature | Discoveries | Retrieve and display USB connected devices (exclude bluetooth on Windows). |
| Professional | Improvement | Queries | Add Query Details button to Query Execute template. |
| Community | Improvement | Discoveries | There was an issue with PHP's SNMPv3 implementation. This is resolved for Linux where we now use net-snmp for initial credential testing. For Windows we cannot do this so the caveat is that where SNMPv3 is used, you must not have multiple credential sets (for SNMPv3) with identical security names. |
| Professional | Improvement | Licenses | Add a license expiry date to /licenses entries. |
| Professional | Improvement | Discoveries | Provide a list of discovery issues with hints to how to resolve them. |
| Professional | Bug | Discoveries | Fix Active Directory discovery type option. AD discoveries now work again. |
| Professional | Bug | Integrations | Fix integrations fields for bool_one_zero and bool_y_n always staying 'false'. |
| Professional | Improvement | Devices | Provide an indication on the Devices List screen to indicate level of audit performed. |
| Community | Bug | Util | Filter out all characters except those in the allowed list for determining number of IPs in range or subnet for util::subnet_size. See Errata - 4.2.0, 3.5.0 and onwards util function vulnerability |
| Community | Bug | All | Fix link creation to exclude user input. See Errata - 4.2.0 and earlier Javascript vulnerability |
| Community | Improvement | All | For spawning processes, no longer use the execute script with a URL, now call PHP directly. No longer a requirement for http to be available from localhost. |
| Community | Improvement | Util | Allow downloading test_windows_client.vbs using the web interface at util/test_windows_client. |
| Community | Improvement | Audit | Improvements to test_windows_client.vbs:
|
| Community | Improvement | Discoveries | Fix audit_linux.sh to allow running on BusyBox. |
| Enterprise | Improvement | Clouds | Delete the associated discovery when we delete the cloud. |
| Community | Improvement | Discoveries | Update the MAC -> Manufacturer helper with more manufacturers. |
| Community | Improvement | Discoveries | Add Fortinet Fortigate models to SNMP Model Helper. |
| Community | Improvement | Discoveries | Detect Quest InTrust Agent in audit_linux.sh. |
| Community | Bug | Devices | Fix for image upload path traversal issue. |
| Community | Improvement | Devices | Automatically add to filter for oae_manage if request from Open-AudIT Enterprise on devices collection. |
| Community | Bug | Devices | Fix running multiple device discoveries from the Bulk Edit screen. |
| Community | Improvement | Discoveries | Make all command line calls from Linux (winexe, smbclient) use a credentials file, rather than put the credentials on the command line. All work in wmi_helper. |
| Community | Improvement | All | Update JS libraries for: jQuery Tablesorter, Bootstrap Table, Bootstrap FileStyle, Chartist. |
| Community | Improvement | Discoveries | More robust scp transfer test for success in ssh_helper. |
| Community | Improvement | Rules | Improve discovery logging in m_rules::execute. |
| Enterprise | Improvement | Collectors | When creating a discovery on a collector, include blank command_options and remove options so we're SQL Strict compliant. |
| Professional | Improvement | Discoveries | Ensure the discovery export function retrieves all discovery logs. |
| Professional | Bug | Devices | Fix broken edit fields for Opmantek Details on devices read template for custom fields. |
| Professional | Improvement | All | Upgrade JS libraries for dataTables and HighCharts. |
| Professional | Improvement | Devices | On device details, only show discovery issues for the latest discovery. |