zabbix: Update to 7.0.21 (lts)

[danielfdickinson]

📦 Package Details

Maintainer: @danielfdickinson

Description:

Updates Zabbix to 7.0.21-r1 (latest 7.0 LTS version)

Security fixes compared to 7.0.12 (most are frontend only):

• GHSA-8m2h-w74v-v385: API hostprototype.get lists data to users with
  insufficient authorization https://support.zabbix.com/browse/ZBX-26988
• GHSA-h34r-wgpp-r3p4: User information disclosure via api_jsonrpc.php on
  method user.get with param search:
  https://support.zabbix.com/browse/ZBX-27060
• GHSA-c945-v35p-v696: LDAP 'Bind password' field value can be leaked by a
  Zabbix Super Admin: https://support.zabbix.com/browse/ZBX-27062
• GHSA-fc6r-7w85-4vgg: Insufficient permission check for the
  problem.view.refresh action:
  https://support.zabbix.com/browse/ZBX-27063
• GHSA-728r-qj99-48p2: Frontend DoS vulnerability due to asymmetric
  resource consumption: https://support.zabbix.com/browse/ZBX-27284

---

🧪 Run Testing Details

• OpenWrt Version: SNAPSHOT (r32307-24b8db118b)
• OpenWrt Target/Subtarget: bcm27xx/bcm2712
• OpenWrt Device: raspberrypi,5-model-b
• Board Profile: rpi-5

Upgraded a 7.0.12-r2 zabbix-server and zabbix-server-frontend (with zabbix-agentd) to this release (7.0.21-r1). Verified operation.

Did note that for the frontend, clearing browser cache, cookies and other site data for the zabbix frontend server was necessary.

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

• It can be applied using git am
• It has been refreshed to avoid offsets, fuzzes, etc., using

  make package/<your-package>/refresh V=s

• N/A It is structured in a way that it is potentially upstreamable

[danielfdickinson]

Removed accidental changes to zabbix_agentd.conf patch.

[hnyman]

Your explanations do not match actual patch content...

Added message into patch header:
6. Include configurations under /etc/zabbix_agentd.d/

Actual content:
Include=/etc/zabbix_agentd.conf.d/

[danielfdickinson]

Your explanations do not match actual patch content...

Fixed. Thank you for the catch @hnyman

[danielfdickinson]

I noticed that 7.0.22 was released Dec 17, 2025. Since it doesn't resolve any new security vulnerabilities, and once this PR is in master I would like to cherry-pick into 25.12, I would like to do the update to 7.0.22 in master only, in another PR.

Does this make sense to you @hnyman @GeorgeSapkin ?

[hnyman]

Sounds ok to be.
This is now merged.

[danielfdickinson]

@hnyman @GeorgeSapkin Do you think that a backport to 24.10 makes sense as well, because there are security fixes, even if not severe?

[hnyman]

Sure, if you can first test it there by yourself.