PT-2020-15825 · Scalyr+1 · Scalyr Agent+1

Published 2020-08-27 · Updated 2022-05-24 · CVE-2020-24714

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Scalyr Agent versions prior to 2.1.10

Description The issue is related to missing SSL certificate validation. In certain circumstances, the openssl binary is called without the -verify hostname option, which can lead to security problems.

Recommendations For versions prior to 2.1.10, update to version 2.1.10 or later to resolve the issue.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-24714

GHSA-W6XV-MF6F-R5F6

PYSEC-2020-251

Affected Products

Scalyr Agent

Openssl

References · 9

• 🔥 https://scalyr-static.s3.amazonaws.com/technical-details/index.html · Exploit
• https://osv.dev/vulnerability/PYSEC-2020-251 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6xv-mf6f-r5f6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24714 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24714 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/scalyr-agent-2/PYSEC-2020-251.yaml · Note
• https://github.com/scalyr/scalyr-agent-2 · Note
• https://github.com/scalyr/scalyr-agent-2/blob/96d5f5bec734c7a0e7c64654cdb7aacc81fdc867/CHANGELOG.md · Note
• https://github.com/scalyr/scalyr-agent-2/commit/96d5f5bec734c7a0e7c64654cdb7aacc81fdc867 · Note