Certificate Renewal Bypass in Icinga 2 by Icinga
CVE-2020-29663

9.1CRITICAL

Key Information:

Vendor

Icinga

Status
Icinga
Vendor
CVE Published:
15 December 2020

What is CVE-2020-29663?

Icinga 2 versions v2.8.0 through v2.11.7 and v2.12.2 introduce a vulnerability allowing revoked certificates due for renewal to be automatically renewed, neglecting the Certificate Revocation List (CRL). This poses significant risks as it permits continued trust in certificates that should have been invalidated, potentially leading to unauthorized access or exploitation. This issue is rectified in Icinga 2 v2.11.8 and v2.12.3.

References

https://github.com/Icinga/icinga2/compare/v2.12.1...v2.12.2
x_refsource_MISC
https://github.com/Icinga/icinga2/security/advisories/GHS...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.