PT-2021-21818 · Icinga+1 · Icinga+1

N-O-X · Published 2021-08-19 · Updated 2024-11-16 · CVE-2021-37698

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Icinga versions 2.5.0 through 2.13.0

Description Icinga is a monitoring system that checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The issue arises in the ElasticsearchWriter, GelfWriter, InfluxdbWriter, and Influxdb2Writer components, which do not verify the server's certificate despite a certificate authority being specified. This affects Icinga 2 instances that connect to time series databases (TSDBs) using TLS over a spoofable infrastructure.

Recommendations For Icinga versions 2.5.0 through 2.13.0, upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. Note that there are no workarounds aside from upgrading.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-37698

DLA-2816-1

DLA-3953-1

GHSA-CXFM-8J5V-5QR2

OPENSUSE-SU-2024:10856-1

SUSE-SU-2022:3725-1

Affected Products

Icinga

Suse

References · 33

• https://osv.dev/vulnerability/CVE-2021-37698 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37698 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3953-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37698 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10856-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37698 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3725-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2816-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37698 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-37698 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-37698 · Vendor Advisory
• https://github.com/Icinga/icinga2/releases/tag/v2.13.1 · Note
• https://github.com/Icinga/icinga2/releases/tag/v2.12.6 · Note
• https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2 · Note
• https://github.com/Icinga/icinga2/releases/tag/v2.11.11 · Note