PT-2024-8523 · Icinga+1 · Icinga 2+1

Fsteglich · Published 2024-10-22 · Updated 2025-11-26 · CVE-2024-49369

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.4.0 through 2.11.12 Icinga 2 versions 2.12.0 through 2.12.11 Icinga 2 versions 2.13.0 through 2.13.10 Icinga 2 versions 2.14.0 through 2.14.3

Description Icinga is a monitoring system used to check network resource availability, notify users of outages, and generate performance reports. A flaw exists in the TLS certificate validation process in all Icinga 2 versions starting from 2.4.0. This allows an attacker to impersonate trusted cluster nodes and API users who utilize TLS client certificates for authentication, specifically those with the client cn attribute set. The vulnerability could allow an attacker to bypass security restrictions and gain unauthorized access to sensitive information or execute arbitrary commands.

Recommendations Update to Icinga 2 version 2.11.12 or later. Update to Icinga 2 version 2.12.11 or later. Update to Icinga 2 version 2.13.10 or later. Update to Icinga 2 version 2.14.3 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2025-14018

BDU:2024-10083

CVE-2024-49369

DLA-3953-1

GHSA-J7WQ-R9MG-9WPV

OPENSUSE-SU-2024:0371-1

OPENSUSE-SU-2024:0372-1

OPENSUSE-SU-2024:14493-1

Affected Products

Alt Linux

Icinga 2

References · 39

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49369.json · Exploit
• https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831 · Patch
• https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe · Patch
• https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8 · Patch
• https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv · Vendor Advisory
• https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c · Patch
• https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 · Patch
• https://ubuntu.com/security/CVE-2024-49369 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-49369 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-49369 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10083 · Security Note
• https://osv.dev/vulnerability/DLA-3953-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0371-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49369 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14493-1 · Vendor Advisory