CVE-2021-37698
Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.
Timeline
ID reserved
By GitHub_M
- 21 days later
· 21 days later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.4% · top 28% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
References (6)
- https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/Icinga/icinga2/releases/tag/v2.11.11 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/Icinga/icinga2/releases/tag/v2.12.6 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/Icinga/icinga2/releases/tag/v2.13.1 (opens in a new tab)x_refsource_MISCx_transferred
- [debian-lts-announce] 20211110 [SECURITY] [DLA 2816-1] icinga2 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-37698)Record last updated .