CVE-2024-49369 json
Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections
published 2024-11-12 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-43406
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
Patch / fix
- icinga icinga_web_2 2.11.12, 2.12.11, 2.13.10, 2.14.3
- icinga2 Debian 12 2.13.6-2+deb12u2
- icinga2 Debian 14, Debian 13 2.14.3-1
debian advisories DEBIAN-CVE-2024-49369
- icinga2 Package Hub 15 SP6, openSUSE Leap 15.6 2.13.10-bp156.4.3.1
- icinga2 Package Hub 15 SP5, openSUSE Leap 15.5 2.13.10-bp155.3.3.1
- icinga2 openSUSE Tumbleweed 2.14.3-1.1
opensuse advisories openSUSE-SU-2024:0372-1openSUSE-SU-2024:0371-1openSUSE-SU-2024:14493-1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
2.94% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Icinga icinga2
- icinga icinga_web_2
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c
patch
-
github.com
/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8
patch
-
github.com
/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe
patch
-
github.com
/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6
patch
-
github.com
/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831
patch
-
github.com
/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv
patch, vendor-advisory
-
icinga.com
/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3
release-notes
-
lists.debian.org
/debian-lts-announce/2024/11/msg00010.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2024-49369
- NVD CVE-2024-49369
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.