CVE-2020-29663 - OpenCVE

Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Icinga	Icinga

Configuration 1 [-]

OR	cpe:2.3:a:icinga:icinga::::::::
	cpe:2.3:a:icinga:icinga:2.12.2:::::::*

References

Link	Resource
https://github.com/Icinga/icinga2/compare/v2.12.1...v2.12.2	Patch Third Party Advisory
https://github.com/Icinga/icinga2/security/advisories/GHSA-pcmr-2p2f-r7j6	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2020-12-15T22:15:35

Updated: 2020-12-15T22:15:35

Reserved: 2020-12-09T00:00:00

Link: CVE-2020-29663

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-12-15T23:15:12.780

Modified: 2020-12-18T16:10:28.983

Link: CVE-2020-29663

JSON object: View

Redhat Information

No data.

CWE

CWE-295

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "44D41D7C-A345-45EB-8614-6AA652C283FC", "versionEndIncluding": "2.11.7", "versionStartIncluding": "2.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:icinga:icinga:2.12.2:*:*:*:*:*:*:*", "matchCriteriaId": "741BA635-D264-457A-8B20-01D19EDD612C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3."}, {"lang": "es", "value": "Icinga versiones 2 v2.8.0 hasta v2.11.7 y versi\u00f3n v2.12.2, presenta un problema en donde los certificados revocados que deben renovarse ser\u00e1n renovados autom\u00e1ticamente, ignorando la CRL. Este problema es corregido en Icinga versiones 2 v2.11.8 y v2.12.3"}], "id": "CVE-2020-29663", "lastModified": "2020-12-18T16:10:28.983", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-15T23:15:12.780", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Icinga/icinga2/compare/v2.12.1...v2.12.2"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-pcmr-2p2f-r7j6"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}