CVE-2020-29663 Security feature bypass in n/a
Icinga 2 automatically renews revoked certificates, bypassing Certificate Revocation List checks and allowing unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-29663?
CVE-2020-29663 is a critical vulnerability in n/a, published on 15 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3.
Weakness: CWE-295
Which versions are affected by CVE-2020-29663?
It affects 1 product.
Linux distribution packages (5)
icinga2 SUSE:Package Hub 15 SP1 | All versions | 2.12.4-bp151.3.6.1 |
icinga2 SUSE:Package Hub 15 SP2 | All versions | 2.12.4-bp152.4.6.1 |
icinga2 SUSE:Package Hub 15 SP3 | All versions | 2.12.4-bp153.2.3.1 |
icinga2 openSUSE:Leap 15.2 | All versions | 2.12.4-lp152.3.6.1 |
icinga2 openSUSE:Leap 15.3 | All versions | 2.12.4-bp153.2.3.1 |
Products include Icinga Icinga.
How do I fix CVE-2020-29663?
Upgrade to a fixed version.
Is CVE-2020-29663 being exploited?
There is no known exploitation of CVE-2020-29663 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-48057 Icinga 2 certificate renewal might incorrectly renew an invalid certificate
- CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery
- CVE-2018-6535 Information disclosure in n/a
- CVE-2020-14004 Path traversal in n/a
- CVE-2018-6533 Privilege escalation in n/a
Sources
Also known as DEBIAN-CVE-2020-29663, GHSA-pcmr-2p2f-r7j6, UBUNTU-CVE-2020-29663, openSUSE-SU-2021:1029-1, openSUSE-SU-2021:1053-1, openSUSE-SU-2021:1054-1 and 1 more.