ZBX-1030 for 1.6.x?

[js1]

Has the vulnerability described in ZBX-1030 been addressed in 1.6.8? Or, is it only fixed in 1.8?

[Alexei]

It is only fixed in 1.8. The problem is that the fix requires changes in communication protocol between the front-end and the server. This would break compatibility with earlier versions of 1.6.x.

[js1]

It is only fixed in 1.8. The problem is that the fix requires changes in communication protocol between the front-end and the server. This would break compatibility with earlier versions of 1.6.x.

What is recommended for mitigating the risks to 1.6.x deployments?

[Alexei]

Actually it WILL be integrated into 1.6.x!

The integration is quite straight-forward, the only drawback is that once it is fixed one should use latest revisions of both front-end and Zabbix server, which is probably what most users already do.

[js1]

Actually it WILL be integrated into 1.6.x!

The integration is quite straight-forward, the only drawback is that once it is fixed one should use latest revisions of both front-end and Zabbix server, which is probably what most users already do.

Sounds good. Looking forward to the fix.