Skip to content
Fencer Vulns
high 7.5

CVE-2021-37698 json

Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer

published 2021-08-19 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-24193

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.

Patch / fix

  • icinga icinga 2.11.10, 2.12.6, 2.13.1
  • icinga2 Debian 14, Debian 13, Debian 12 2.13.1-1

debian advisories DEBIAN-CVE-2021-37698

  • icinga2 SLE Module for HPC 12 2.8.2-3.6.1

suse advisories SUSE-SU-2022:3725-1

  • icinga2 openSUSE Tumbleweed 2.13.1-1.3

opensuse advisories openSUSE-SU-2024:10856-1

  • icinga2 Alpine 3.14 2.12.6-r0
  • icinga2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 2.13.1-r0

alpine advisories ALPINE-CVE-2021-37698

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Icinga icinga2

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.