CVE-2021-37698

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-37698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37698.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-37698
Downstream
Related
Published
2021-08-19T16:15:12.420Z
Modified
2026-03-15T22:37:36.951209Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.

References

Affected packages

Git / github.com/icinga/icinga2

Affected ranges

Type
GIT
Repo
https://github.com/icinga/icinga2
Events
Introduced
5e8ae440c010f7af36e7db5fd077597e8131ba58
Fixed
3e0cfde299e2e8b999283aab72776dd99046df0a
Introduced
338d0aaa8ca17b94cc84048d4811c0c478f363a4
Fixed
88ed37454b7d8290d0f309784a166ab0d3c23326
Introduced
aaccd0448feff8769b3c825c5c13b9fd6fbeed27
Fixed
4951cdf5610f6ab37ac86263143d99a9c0c8beb3
Fixed
08e2d9fc00f1eaebc40404f69a602644f3f032f6
Database specific 
{
    "versions": [
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.11.10"
        },
        {
            "introduced": "2.12.0"
        },
        {
            "fixed": "2.12.6"
        },
        {
            "introduced": "2.13.0"
        },
        {
            "fixed": "2.13.1"
        }
    ]
}

Affected versions

v2.*
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.11.0
v2.11.0-rc1
v2.11.1
v2.11.2
v2.11.3
v2.11.4
v2.11.5
v2.11.6
v2.11.7
v2.11.8
v2.11.9
v2.12.0
v2.12.0-rc1
v2.12.1
v2.12.2
v2.12.3
v2.12.4
v2.12.5
v2.13.0
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.7.0
v2.7.1
v2.7.2
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.9.0
v2.9.1
v2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37698.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]