Vulnerability Name:

CVE-2020-29663 (CCN-193548)

Assigned:2020-12-15
Published:2020-12-15
Updated:2020-12-18
Summary:Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3.
CVSS v3 Severity:9.1 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
7.9 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-295
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2020-29663

Source: XF
Type: UNKNOWN
icinga2-cve202029663-weak-security(193548)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/Icinga/icinga2/compare/v2.12.1...v2.12.2

Source: CCN
Type: Icinga 2 GIT Repository
Revoked certificates due for renewal will automatically be renewed ignoring the CRL

Source: MISC
Type: Third Party Advisory
https://github.com/Icinga/icinga2/security/advisories/GHSA-pcmr-2p2f-r7j6

Vulnerable Configuration:Configuration 1:
  • cpe:/a:icinga:icinga:*:*:*:*:*:*:*:* (Version >= 2.8.0 and <= 2.11.7)
  • OR cpe:/a:icinga:icinga:2.12.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:icinga:icinga:2.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:icinga:icinga:2.11.7:*:*:*:*:*:*:*
  • OR cpe:/a:icinga:icinga:2.12.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:93629
    P
    		 (Important)
    2022-07-14
    oval:org.opensuse.security:def:93631
    P
    		 (Important)
    2022-02-04
    oval:org.opensuse.security:def:112427
    P
    		icinga2-2.13.1-1.3 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:100344
    P
    		 (Moderate)
    2021-10-27
    oval:org.opensuse.security:def:105933
    P
    		icinga2-2.13.1-1.3 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:109760
    P
    		Security update for icinga2 (Moderate)
    2021-07-24
    oval:org.opensuse.security:def:11108
    P
    		Security update for icinga2 (Moderate)
    2021-07-24
    oval:org.opensuse.security:def:111489
    P
    		Security update for icinga2 (Moderate)
    2021-07-24
    oval:org.opensuse.security:def:96413
    P
    		Security update for icinga2 (Moderate)
    2021-07-24
    oval:org.opensuse.security:def:103103
    P
    		Security update for icinga2 (Moderate)
    2021-07-24
    oval:org.opensuse.security:def:110989
    P
    		Security update for icinga2 (Moderate)
    2021-07-24
    oval:org.opensuse.security:def:11105
    P
    		Security update for icinga2 (Moderate)
    2021-07-21
    oval:org.opensuse.security:def:111487
    P
    		Security update for icinga2 (Moderate)
    2021-07-21
    oval:org.opensuse.security:def:96410
    P
    		Security update for icinga2 (Moderate)
    2021-07-19
    oval:org.opensuse.security:def:103100
    P
    		Security update for icinga2 (Moderate)
    2021-07-19
    oval:org.opensuse.security:def:11102
    P
    		Security update for icinga2 (Moderate)
    2021-07-19
    oval:org.opensuse.security:def:100342
    P
    		Security update for icinga2 (Moderate)
    2021-07-19
    oval:org.opensuse.security:def:11103
    P
    		Security update for icinga2 (Moderate)
    2021-07-19
    oval:org.opensuse.security:def:109757
    P
    		Security update for icinga2 (Moderate)
    2021-07-19
    oval:org.opensuse.security:def:110966
    P
    		Security update for icinga2 (Moderate)
    2021-07-12
    BACK
    icinga icinga *
    icinga icinga 2.12.2
    icinga icinga 2.8.0
    icinga icinga 2.11.7
    icinga icinga 2.12.2