Improper certificate validation in Icinga - CVE-2025-48057

Vulnerability identifier: #VU109861

CSH Severity: High

CVSS v4: 7.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N]

CVE-ID: CVE-2025-48057

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to impersonate trusted nodes.

The vulnerability exists due to an error within the VerifyCertificate() function that can be tricked into issuing a valid certificate. A remote attacker can send a specially crafted certificate request and request renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes.

Icinga
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
HPC Module
icinga2-libs
icinga2-ido-mysql-debuginfo
icinga2-common
icinga2-bin-debuginfo
icinga2-debugsource
icinga2-libs-debuginfo
icinga2-doc
icinga2-bin
icinga2-ido-pgsql-debuginfo
icinga2-ido-pgsql
vim-icinga2
icinga2
icinga2-ido-mysql

Install updates from vendor's website.

Icinga - addressed in versions 2.12.12, 2.13.12, 2.14.6
icinga2-libs - update to 2.8.2-3.11.2
icinga2-ido-mysql-debuginfo - update to 2.8.2-3.11.2
icinga2-common - update to 2.8.2-3.11.2
icinga2-bin-debuginfo - update to 2.8.2-3.11.2
icinga2-debugsource - update to 2.8.2-3.11.2
icinga2-libs-debuginfo - update to 2.8.2-3.11.2
icinga2-doc - update to 2.8.2-3.11.2
icinga2-bin - update to 2.8.2-3.11.2
icinga2-ido-pgsql-debuginfo - update to 2.8.2-3.11.2
icinga2-ido-pgsql - update to 2.8.2-3.11.2
vim-icinga2 - update to 2.8.2-3.11.2
icinga2 - update to 2.8.2-3.11.2
icinga2-ido-mysql - update to 2.8.2-3.11.2

• https://github.com/Icinga/icinga2/security/advisories/GHSA-7vcf-f5v9-3wr6

• Node impersonation through unauthorized certificate renewal in Icinga
• SUSE update for icinga2