CVE-2021-37698 Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer
Attackers can intercept TLS traffic to time-series databases due to missing certificate validation in Icinga 2 writers, exposing sensitive monitoring data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-37698?
CVE-2021-37698 is a high-severity vulnerability in Debian Debian Linux, published on 19 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.
Weakness: CWE-295
Which versions are affected by CVE-2021-37698?
It affects 2 products.
Products include Debian Debian Linux, Icinga Icinga.
How do I fix CVE-2021-37698?
Upgrade to a fixed version.
Is CVE-2021-37698 being exploited?
There is no known exploitation of CVE-2021-37698 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2021-37698, GHSA-cxfm-8j5v-5qr2, UBUNTU-CVE-2021-37698.