CVE - CVE-2024-49369

CVE-ID
CVE-2024-49369	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c URL:https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c MISC:https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8 URL:https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8 MISC:https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe URL:https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe MISC:https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 URL:https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 MISC:https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831 URL:https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831 MISC:https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv URL:https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv MISC:https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3 URL:https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20241014	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241014)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)