Icinga 2 v2.14.5

This release fixes a regression introduced in 2.14.4 that caused the icinga2 node setup, icinga2 node wizard, and icinga2 pki request commands to fail if a certificate was requested from a node that has to forward the request to another node for signing. Additionally, it fixes a small bug in the performance data normalization and includes various documentation improvements.

Bug Fixes

• Don't close anonymous connections before sending the response for a certificate request #10337
• Performance data: Don't discard min/max values even if crit/warn thresholds aren’t given #10339
• Fix a failing test case on systems time_t is only 32 bits #10343

Documentation

• Document the -X option for the mail-host-notification and mail-service-notification commands #10335
• Include Nagios in the migration docs #10324
• Remove RHEL 7 from installation instructions #10334
• Add instructions for installing build dependencies on Windows Server #10336

Icinga 2 v2.14.4

This bugfix release is focused on improving HA cluster stability and easing
troubleshooting of issues in this area. It also addresses several crashes,
in the core itself and both in Icinga DB and IDO (numbers out of range).
In addition, it fixes several other issues such as lost notifications
or TimePeriod/ScheduledDowntime exceeding specified date ranges.

Crash Fixes

• Invalid DateTime#format() arguments in config and console on Windows Server 2016 and older. #10112
• Downtime scheduling at runtime with non-existent trigger. #10049
• Object creation at runtime during Icinga DB initialization. #10151
• Comment on a service of a non-existent host. #9861

Miscellaneous Bugfixes

• Lost notifications after recovery outside the notification time period. #10187
• TimePeriod/ScheduledDowntime exceeding specified date range. #9983 #10107
• Clean up failure for obsolete Downtimes. #10062
• ifw-api check command: use correct process-finished handler. #10140
• Email notification scripts: strip 0x0D (CR) for a proper Content-Type. #10061
• Several fixes and improvements of the code quality. #10066 #10214 #10254 #10263 #10264

Cluster and API

• Sync runtime objects in topological order to honor their dependencies. #10000
• Make parallel config syncs more robust. #10013
• After object creation via API fails, clean up properly for the next try. #10111
• Close HTTPS connections properly to prevent leaks. #10005 #10006
• Reduce the number of cluster messages in memory at the same time. #9991 #9999 #10210
• Once a cluster connection shall be closed, stop communicating. #10213 #10221
• Remove unnecessary blocking of semaphores. #9992 #9994
• Reduce unnecessary cluster messages setting the next check time. #10011

Icinga DB and IDO

• IDO: fix object relations after aborted synchronization. #10065
• Icinga DB, IDO: limit all timestamps to four year digits. #10058 #10059
• Icinga DB: limit execution_time and latency (milliseconds) to database schema. #10060

Troubleshooting

• Add /v1/debug/malloc_info which calls malloc_info(3) if available. #10015
• Add log messages about own network I/O. #9993 #10141 #10207
• Several fixes and improvements of log messages. #9997 #10021 #10209

Windows

• Update OpenSSL shipped on Windows to v3.0.15. #10170
• Update Boost shipped on Windows to v1.86. #10114
• Support CMake v3.29. #10037
• Don't require to build .msi as admin. #10137
• Build configuration scripts: allow custom $CMAKE_ARGS. #10312

Documentation

• Distributed Monitoring: add section "External CA/PKI". #9825
• Explain how to enable/disable debug logging on the fly. #9981
• Update supported OS versions and repository configuration. #10064 #10090 #10120 #10135 #10136 #10205
• Several fixes and improvements. #9960 #10050 #10071 #10156 #10194
• Replace broken links. #10115 #10118 #10282
• Fix typographical and similarly trivial errors. #9953 #9967 #10056 #10116 #10152 #10153 #10204

Icinga 2 v2.13.11

This bugfix release addresses several crashes,
both in the core itself and in Icinga DB (numbers out of range).
In addition, it fixes several other issues such as lost notifications
or TimePeriod/ScheduledDowntime exceeding specified date ranges.

Crash Fixes

• Invalid DateTime#format() arguments in config and console on Windows Server 2016 and older. #10165
• Downtime scheduling at runtime with non-existent trigger. #10127
• Object creation at runtime during Icinga DB initialization. #10164
• Icinga DB: several numbers out of database schema range. #10244

Miscellaneous Bugfixes

• Lost notifications after recovery outside the notification time period. #10241
• TimePeriod/ScheduledDowntime exceeding specified date range. #10128 #10133
• Make parallel config syncs more robust. #10126
• Reduce unnecessary cluster messages setting the next check time. #10168

Windows

• Update OpenSSL shipped on Windows to v3.0.15. #10175
• Update Boost shipped on Windows to v1.86. #10134
• Support CMake v3.29. #10087
• Don't require to build .msi as admin. #10305
• Build configuration scripts: allow custom $CMAKE_ARGS. #10315

Icinga 2 v2.14.3

This security release fixes a TLS certificate validation bypass.
Given the severity of that issue, users are advised to upgrade all nodes immediately.

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

Icinga 2 v2.13.10

This security release fixes a TLS certificate validation bypass.
Given the severity of that issue, users are advised to upgrade all nodes immediately.

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

Icinga 2 v2.12.11

This security release fixes a TLS certificate validation bypass.
Given the severity of that issue, users are advised to upgrade all nodes immediately.

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

Icinga 2 v2.11.12

This security release fixes a TLS certificate validation bypass. Given the severity of that issue, users are advised to upgrade all nodes immediately.

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

Icinga 2 v2.14.2

Version 2.14.2 is a hotfix release for master nodes that mainly fixes excessive disk usage caused by the InfluxDB writers.

• InfluxDB: truncate timestamps to whole seconds to save disk space. #9969
• HttpServerConnection: log request processing time as well. #9970
• Update Boost shipped on Windows to v1.84. #9970

Icinga 2 v2.14.1

Version 2.14.1 is a hotfix release for masters and satellites that mainly
prevents permanent disintegration of a whole cluster due to root CA expiry.

Security

• Automatically renew own root CA and distribute it to all nodes. #9933
• Update OpenSSL shipped on Windows to v3.0.12. #9946
• Disable TLS renegotiation (handshake on existing connection). #9946

Bugfixes

• Icinga DB feature: fix crash due to missing NULL pointer check. #9946
• Icinga DB feature: fix data written into Redis crashing the Go daemon. #9946
• GelfWriter: fix deadlock on stop/reload caused by busy queue. #9947
• Don't lose notifications due to too long output, truncate it. #9947

Enhancements

• Discard duplicate problem notifications due to state filtering. #9932
• Speed up API filters targeting specific hosts/services to O(1). #9944
• POST /v1/console/*: return HTTP 503 while Icinga is reloading. #9947
• Update Boost shipped on Windows to v1.83. #9946
• Documentation: several fixes and improvements. #9921

Icinga 2 v2.13.9

Version 2.13.9 is a hotfix release for masters and satellites that mainly
prevents permanent disintegration of a whole cluster due to root CA expiry.

Security

• Automatically renew own root CA and distribute it to all nodes. #9934
• Update OpenSSL shipped on Windows to v3.0.12. #9945
• Disable TLS renegotiation (handshake on existing connection). #9945

Bugfixes

• Icinga DB feature: fix crash due to missing NULL pointer check. #9945
• Icinga DB feature: fix data written into Redis crashing the Go daemon. #9945

Updates

• Update Boost shipped on Windows to v1.83. #9945