This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Icinga 2 fixes a critical vulnerability
Icinga fixes a critical vulnerability in Icinga 2 with versions v2.14.3, v2.13.10, v2.12.11 and v2.11.12. If updating to a fixed version is not possible, access to the Icinga 2 API port can be restricted using a firewall to mitigate the potential impact [1]. Among operating systems, Gentoo has released a fix in version 2.14.3 for the most commonly used architectures [2]. Debian provides a fix only for the sid release in version 2.14.3-1 [3].
An unauthenticated remote attacker is able, through insufficient TLS certificate validation, to execute commands and change the configuration without authorization if the "accept_commands" or "accept_config" attribute of the ApiListener object is set to "true", respectively. If the attributes are not set this way, the attacker is still able to obtain potentially sensitive information [4].
The vulnerability is present in product:
- Icinga 2; >=v2.4.0, <v2.11.12; >=v2.12.0, <v2.12.11; >=v2.13.0, <v2.13.10; >=v2.14.0, <v2.14.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-49369 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Links
By CESNET, z.s.p.o. Michaela Ručková on 13. 11. 2024.