CVE-2021-37698

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

History

03 Dec 2021, 02:31

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
References (MLIST) https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html - (MLIST) https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html - Mailing List, Third Party Advisory

11 Nov 2021, 00:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html -

26 Aug 2021, 12:03

Type Values Removed Values Added
References (CONFIRM) https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2 - (CONFIRM) https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2 - Third Party Advisory
References (MISC) https://github.com/Icinga/icinga2/releases/tag/v2.13.1 - (MISC) https://github.com/Icinga/icinga2/releases/tag/v2.13.1 - Release Notes, Third Party Advisory
References (MISC) https://github.com/Icinga/icinga2/releases/tag/v2.12.6 - (MISC) https://github.com/Icinga/icinga2/releases/tag/v2.12.6 - Release Notes, Third Party Advisory
References (MISC) https://github.com/Icinga/icinga2/releases/tag/v2.11.11 - (MISC) https://github.com/Icinga/icinga2/releases/tag/v2.11.11 - Release Notes, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 5.0
v3 : 7.5
CPE cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*

19 Aug 2021, 16:42

Type Values Removed Values Added
New CVE

Information

Published : 2021-08-19 16:15

Updated : 2024-02-04 21:47


NVD link : CVE-2021-37698

Mitre link : CVE-2021-37698

CVE.ORG link : CVE-2021-37698


JSON object : View

Products Affected

icinga

  • icinga

debian

  • debian_linux
CWE
CWE-295

Improper Certificate Validation