PT-2020-15826 · Scalyr · Scalyr Agent

Published 2020-08-27 · Updated 2022-05-24 · CVE-2020-24715

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Scalyr Agent versions prior to 2.1.10

Description The issue is related to missing SSL certificate validation. In certain circumstances, native Python code is used without comparing the hostname to commonName and subjectAltName, which can lead to security problems.

Recommendations For versions prior to 2.1.10, update to version 2.1.10 or later to resolve the issue.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-24715

GHSA-738X-V49G-P6HX

PYSEC-2020-252

Affected Products

Scalyr Agent

References · 9

• 🔥 https://scalyr-static.s3.amazonaws.com/technical-details/index.html · Exploit
• https://osv.dev/vulnerability/GHSA-738x-v49g-p6hx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24715 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-252 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24715 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/scalyr-agent-2/PYSEC-2020-252.yaml · Note
• https://github.com/scalyr/scalyr-agent-2/blob/v2.1.10/CHANGELOG.md · Note
• https://github.com/scalyr/scalyr-agent-2 · Note
• https://web.archive.org/web/20211209045826/https://scalyr-static.s3.amazonaws.com/technical-details/index.html · Note