PT-2019-18667 · Elastic · Apm Agent For Ruby

Published 2019-07-30 · Updated 2023-03-03 · CVE-2019-7615

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Elastic APM agent for Ruby versions prior to 2.9.0

Description A TLS certificate validation flaw was found in the Elastic APM agent for Ruby. When specifying a trusted server CA certificate via the server ca cert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man-in-the-middle style attack against the Ruby agent.

Recommendations For Elastic APM agent for Ruby versions prior to 2.9.0, update to version 2.9.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the server ca cert setting until a patch is available. Restrict access to the APM server to minimize the risk of exploitation. Avoid using the server ca cert setting in the affected configuration until the issue is resolved.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-7615

GHSA-35J2-P8FH-X966

Affected Products

Apm Agent For Ruby

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/elastic-apm/CVE-2019-7615.yml · Exploit
• https://osv.dev/vulnerability/GHSA-35j2-p8fh-x966 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-7615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7615 · Security Note
• https://github.com/elastic/apm-agent-ruby/pull/449 · Note
• https://github.com/elastic/apm-agent-ruby · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7615 · Note