CVE-2021-37698
Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 19, 2021
- Updated
- Nov 3, 2025
- Reserved
- Jul 29, 2021
Description
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
icinga2Icinga |
|
References
- https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2
- https://github.com/Icinga/icinga2/releases/tag/v2.11.11
- https://github.com/Icinga/icinga2/releases/tag/v2.12.6
- https://github.com/Icinga/icinga2/releases/tag/v2.13.1
- [debian-lts-announce] 20211110 [SECURITY] [DLA 2816-1] icinga2 security updatemailing-list
- https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.