SB2024120709 - Gentoo update for icinga2
Published: December 7, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper Certificate Validation (CVE-ID: CVE-2020-29663)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass certificate revocation checks.
The vulnerability exists due to improper certificate validation in the ApiListener certificate renewal logic when processing certificate renewal requests. A remote user can request automatic renewal of a revoked certificate to bypass certificate revocation checks.
Only setups using external certificate signing are affected, and exploitation requires that a CRL is configured and that the revoked certificate is eligible for automatic renewal because it was issued before 2017 or expires in less than 30 days.
2) Improper access control (CVE-ID: CVE-2021-32739)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to steal more privileged identities.
The vulnerability exists due to improper access control in ApiListener object query results when handling API object queries. A remote user can query ApiListener objects to obtain the ticket salt and request a certificate for an arbitrary common name to steal more privileged identities.
Exploitation requires credentials for an API user with permission to query objects.
3) Improper access control (CVE-ID: CVE-2021-32743)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the Icinga API object query handling for IdoMysqlConnection, IdoPgsqlConnection, IcingaDB, and ElasticsearchWriter objects when processing read requests for corresponding object types. A remote user can query affected objects to disclose sensitive information.
Exposed credentials may allow access to external database, Redis, or Elasticsearch services with the permissions assigned to those credentials.
4) Improper Certificate Validation (CVE-ID: CVE-2021-37698)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to intercept sensitive information.
The vulnerability exists due to improper certificate validation in ElasticsearchWriter, GelfWriter, InfluxdbWriter, and Influxdb2Writer when establishing TLS connections to configured TSDB servers. A remote attacker can present a spoofed certificate to intercept sensitive information.
Exploitation requires a spoofable network infrastructure between the affected instance and the target TSDB service.
5) Improper Certificate Validation (CVE-ID: CVE-2024-49369)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to impersonate trusted cluster nodes or API users and execute arbitrary commands, modify configuration, or disclose sensitive information.
The vulnerability exists due to improper certificate validation in JSON-RPC and HTTP API connections when establishing TLS-authenticated connections. A remote attacker can present a crafted certificate to impersonate trusted identities to execute arbitrary commands, modify configuration, or disclose sensitive information.
Additional impact depends on whether distributed installations accept configuration updates or commands, and on the permissions assigned to certificate-authenticated API users.
Remediation
Install update from vendor's website.