NVD Vulnerability Detail

CVE-2021-37698

Summary	Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.
Publication Date	Aug. 20, 2021, 1:15 a.m.
Registration Date	Aug. 20, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:15 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://github.com/Icinga/icinga2/releases/tag/v2.11.11	Release Notes Third Party Advisory
2	https://github.com/Icinga/icinga2/releases/tag/v2.11.11	Release Notes Third Party Advisory
3	https://github.com/Icinga/icinga2/releases/tag/v2.12.6	Release Notes Third Party Advisory
4	https://github.com/Icinga/icinga2/releases/tag/v2.12.6	Release Notes Third Party Advisory
5	https://github.com/Icinga/icinga2/releases/tag/v2.13.1	Release Notes Third Party Advisory
6	https://github.com/Icinga/icinga2/releases/tag/v2.13.1	Release Notes Third Party Advisory
7	https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2	Third Party Advisory
8	https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2	Third Party Advisory
9	https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html	Mailing List Third Party Advisory
10	https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html	Mailing List Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-295	不正な証明書検証	https://cwe.mitre.org/data/definitions/295.html

JVN Vulnerability Information

Icinga における証明書検証に関する脆弱性

Title	Icinga における証明書検証に関する脆弱性
Summary	Icinga には、証明書検証に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 19, 2021, midnight
Registration Date	Aug. 30, 2022, 2:08 p.m.
Last Update	Aug. 30, 2022, 2:08 p.m.

Affected System

Debian

Debian GNU/Linux

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-37698	https://www.cve.org/CVERecord?id=CVE-2021-37698
National Vulnerability Database (NVD)
2	CVE-2021-37698	https://nvd.nist.gov/vuln/detail/CVE-2021-37698

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-295	https://cwe.mitre.org/data/definitions/295.html

ベンダー情報

No	Name	URL
Debian
1	[SECURITY] [DLA 2816-1] icinga2 security update	https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html
GitHub
2	Icinga 2 v2.11.11	https://github.com/Icinga/icinga2/releases/tag/v2.11.11
3	Icinga 2 v2.12.6	https://github.com/Icinga/icinga2/releases/tag/v2.12.6
4	Icinga 2 v2.13.1	https://github.com/Icinga/icinga2/releases/tag/v2.13.1

Change Log

No	Changed Details	Date of change
1	[2022年08月30日] 掲載	Aug. 30, 2022, 2:08 p.m.