{"id":"CVE-2021-37698","aliases":["ALPINE-CVE-2021-37698","DEBIAN-CVE-2021-37698","DLA-2816-1","DLA-3953-1","EUVD-2021-24193","GHSA-cxfm-8j5v-5qr2","SUSE-SU-2022:3725-1","UBUNTU-CVE-2021-37698","openSUSE-SU-2024:10856-1"],"status":"published","title":"Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01381,"percentile":0.72494,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-08-19T13:55:10Z","modified":"2026-11-03T06:32:41Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"icinga2","fixed_in":["2.12.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"icinga2","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"icinga2","fixed_in":["2.13.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icinga2","fixed_in":["2.13.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icinga2","fixed_in":["2.13.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-2+deb9u2"}]}],"versions":["2.6.0-2","2.6.0-2+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1+deb11u1"}]}],"versions":["2.12.3-1"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-1build1","2.3.11-1","2.4.0-1","2.4.1-1","2.4.1-2","2.4.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.0-1","2.8.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.5-1build1","2.11.2-1","2.11.2-1ubuntu1","2.11.2-1ubuntu2","2.11.2-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1","2.13.1-1","2.13.2-1","2.13.2-1build1","2.13.2-1build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"icinga2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-1.3"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"icinga","product":"icinga"},{"vendor":"icinga","product":"icinga2"}],"references":[{"url":"https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.11.11","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.12.6","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.13.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-37698","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-37698","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223725-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172171","tags":["report"]},{"url":"https://bugzilla.suse.com/1180147","tags":["report"]},{"url":"https://bugzilla.suse.com/1189653","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-37698","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-37698","tags":["report"]},{"url":"https://icinga.com/blog/2021/08/19/icinga-2-13-1-security-release/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37698","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32743","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-37698","title":"Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","status":"published","published":"2021-08-19T13:55:10Z","modified":"2025-11-03T21:45:10.788Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-24193","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","status":"published","published":"2021-08-19T13:55:10Z","modified":"2025-11-03T21:45:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:31.7352Z"}],"nvd":[{"id":"CVE-2021-37698","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","status":"published","published":"2021-08-19T16:15:12.42Z","modified":"2026-06-17T04:01:00.543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:57.318236Z"}],"osv":[{"id":"ALPINE-CVE-2021-37698","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","status":"published","published":"2021-08-19T16:15:12.42Z","modified":"2026-11-03T06:32:41.055285572Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2021-37698","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","status":"published","published":"2021-08-19T16:15:12.42Z","modified":"2026-10-24T10:50:12.703509486Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-37698","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","status":"published","published":"2021-08-19T16:15:12.42Z","modified":"2026-10-23T18:03:30.38500832Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"UBUNTU-CVE-2021-37698","description":"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.","status":"published","published":"2021-08-19T16:15:00Z","modified":"2025-10-24T04:50:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"DLA-2816-1","title":"icinga2 - security update","status":"published","published":"2021-11-10T00:00:00Z","modified":"2026-03-09T01:18:24.54256Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3953-1","title":"icinga2 - security update","status":"published","published":"2024-11-16T00:00:00Z","modified":"2026-03-09T01:23:14.428478Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:10856-1","title":"icinga2-2.13.1-1.3 on GA media","description":"These are all security issues fixed in the icinga2-2.13.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:04.697166Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2022:3725-1","title":"Security update for icinga2","description":"This update for icinga2 fixes the following issues:\n\n- CVE-2020-14004: prepare-dirs script allows for symlink attack in the icinga user context. (bsc#1172171)\n- CVE-2020-29663: ignoring CRL, where revoked certificates due for renewal will automatically be renewed. (bsc#281137)\n- CVE-2021-37698: Missing TLS server certificate validation in ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer. (bsc#281137)\n","status":"published","published":"2022-10-25T10:49:03Z","modified":"2025-05-02T04:30:29.624652Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}