CVE-2024-41811

Name	CVE-2024-41811
Description	ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
icinga-php-library (PTS)	bookworm	0.10.1-1	vulnerable
	sid, trixie	0.14.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
icinga-php-library	source	(unstable)	0.14.1-1

Notes

[bookworm] - icinga-php-library <no-dsa> (Minor issue)
https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j
https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e (v0.10.1)
Fix integrated into icinga-php-library/0.14.1 release:
https://github.com/Icinga/icinga-php-library/commit/20c73075a9e9824d089bbd2e433bb2f613fd5801