Log in Start free

Vulnerability · Published Aug 19, 2021 · Assigned by GitHub_M

CVE-2021-37698Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer

High 7.5

In plain English

A high-severity improper certificate validation in icinga2 from Icinga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 27.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20icinga22.13.1-r0ALPINE-CVE-2021-37698
Alpine:v3.21icinga22.13.1-r0ALPINE-CVE-2021-37698
Alpine:v3.22icinga22.13.1-r0ALPINE-CVE-2021-37698
Alpine:v3.23icinga22.13.1-r0ALPINE-CVE-2021-37698
Alpine:v3.24icinga22.13.1-r0ALPINE-CVE-2021-37698
Debian:12icinga22.13.1-1DEBIAN-CVE-2021-37698
Debian:13icinga22.13.1-1DEBIAN-CVE-2021-37698
Debian:14icinga22.13.1-1DEBIAN-CVE-2021-37698
Ubuntu:22.04:LTSicinga2no fix listedUBUNTU-CVE-2021-37698

Affected products (as reported)

VendorProductVersions
Icinga icinga2 >= 2.5.0, <= 2.13.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References