UBUNTU-CVE-2021-37698

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-37698

    UBUNTU-CVE-2021-37698

    Published: 19 Aug 2021Last Modified: 24 Oct 2025
    Upstream:
    CVE-2021-37698

    Summary:

    Details: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.

    References: https://ubuntu.com/security/CVE-2021-37698, https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2, https://icinga.com/blog/2021/08/19/icinga-2-13-1-security-release/, https://github.com/Icinga/icinga2/releases/tag/v2.13.1, https://github.com/Icinga/icinga2/releases/tag/v2.12.6, https://github.com/Icinga/icinga2/releases/tag/v2.11.11, https://www.cve.org/CVERecord?id=CVE-2021-37698

    Affected packages

    Package

    Name: icinga2

    Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    2.3.8-1build1
    2.3.11-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-37698 | CVE-DB