Flawed TLS Certificate Validation in Icinga V2 Allowing Impersonation
CVE-2024-49369
9.8CRITICAL
What is CVE-2024-49369?
A vulnerability in Icinga 2, a monitoring system designed to check network resource availability, allows attackers to exploit flawed TLS certificate validation. This flaw enables impersonation of trusted cluster nodes and API users utilizing TLS client certificates for authentication. Attackers can potentially gain unauthorized access to critical network management functionalities, underscoring the importance of addressing this security concern. The issue has been rectified in the latest versions: 2.14.3, 2.13.10, 2.12.11, and 2.11.12.
Affected Version(s)
icinga2 >= 2.4.0, < 2.11.12 < 2.4.0, 2.11.12
icinga2 >= 2.12.0, < 2.12.11 < 2.12.0, 2.12.11
icinga2 >= 2.13.0, < 2.13.10 < 2.13.0, 2.13.10