CVE-2024-49369

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Icinga es un sistema de monitoreo que verifica la disponibilidad de los recursos de red, notifica a los usuarios sobre interrupciones y genera datos de rendimiento para informes. La validación del certificado TLS en todas las versiones de Icinga 2 a partir de la 2.4.0 tenía fallas, lo que permitía a un atacante hacerse pasar tanto por nodos de clúster confiables como por cualquier usuario de API que use certificados de cliente TLS para autenticación (objetos ApiUser con el atributo client_cn establecido). Esta vulnerabilidad se ha corregido en v2.14.3, v2.13.10, v2.12.11 y v2.11.12.