CVE-2021-37698

    Dashboard / Vulnerabilities / CVE-2021-37698

    CVE-2021-37698

    Published: 19 Aug 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.

    References: https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html, https://github.com/Icinga/icinga2/releases/tag/v2.11.11, https://github.com/Icinga/icinga2/releases/tag/v2.12.6, https://github.com/Icinga/icinga2/releases/tag/v2.13.1, https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2, https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5e8ae440c010f7af36e7db5fd077597e8131ba58
    Fixed -3e0cfde299e2e8b999283aab72776dd99046df0a

    Affected versions

    v2.13.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-37698 | CVE-DB