PT-2021-21362 · Siren · Siren Investigate

Published 2021-11-02 · Updated 2021-11-04 · CVE-2021-36794

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siren Investigate versions prior to 11.1.4

Description The issue occurs when the cluster feature of the Siren Alert application is enabled, causing TLS verifications to be disabled globally in the Siren Investigate main process.

Recommendations For versions prior to 11.1.4, update to version 11.1.4 or later to resolve the issue.

Fix

Related Identifiers

CVE-2021-36794

Affected Products

Siren Investigate

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-36794 · Security Note
• https://community.siren.io/c/announcements · Vendor Advisory
• https://docs.siren.io/siren-platform-user-guide/11.1/release-notes.html#_security_fixes_3 · Vendor Advisory
• https://docs.siren.io/index · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36794 · Vendor Advisory
• https://t.me/cibsecurity/31605 · Telegram Post