BSD Portsicinga2 -- TLS Certificate Validation Bypass
· CVE-2024-49369 · VuXML entry
The Icinga project reports: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser …
Affected versions
- icinga2 < 2.14.3
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | net-mgmt/icinga2 | 2.16.5_1 | fixed | (597 days after) |
| OpenBSD | net/icinga/core2 | 2.16.5p0v0 | out of range, by version | |
| NetBSD | net/icinga2 | 2.16.5nb2 | not listed |