Log in Start free

Vulnerability · Published Nov 12, 2024 · Assigned by GitHub_M

CVE-2024-49369Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

Critical 9.8

In plain English

A critical-severity improper certificate validation in icinga2 from Icinga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12icinga22.13.6-2+deb12u2DEBIAN-CVE-2024-49369
Debian:13icinga22.14.3-1DEBIAN-CVE-2024-49369
Debian:14icinga22.14.3-1DEBIAN-CVE-2024-49369
Ubuntu:22.04:LTSicinga2no fix listedUBUNTU-CVE-2024-49369
Ubuntu:24.04:LTSicinga2no fix listedUBUNTU-CVE-2024-49369

Affected products (as reported)

VendorProductVersions
Icinga icinga2 >= 2.4.0, < 2.11.12>= 2.12.0, < 2.12.11>= 2.13.0, < 2.13.10>= 2.14.0, < 2.14.3

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References