CVE-2021-32739: Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities
First published: Thu Jul 15 2021(Updated: )
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icinga Icinga | >=2.4.0<2.11.10 | |
| Icinga Icinga | >=2.12.0<2.12.5 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-32739?
CVE-2021-32739 is a vulnerability in Icinga, a monitoring system, that may allow privilege escalation for authenticated API users.
What is the severity of CVE-2021-32739?
CVE-2021-32739 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2021-32739?
CVE-2021-32739 affects Icinga versions 2.4.0 through 2.12.4.
How can I fix CVE-2021-32739?
To fix CVE-2021-32739, you should upgrade to Icinga versions 2.12.5 or 2.11.10.
Where can I find more information about CVE-2021-32739?
You can find more information about CVE-2021-32739 at the following references: [1](https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5), [2](https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/), [3](https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html).
- collector/nvd-index
- agent/type
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/references
- agent/last-modified-date
- agent/tags
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- vendor/icinga
- canonical/icinga icinga
- version/icinga icinga/2.4.0
- version/icinga icinga/2.12.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0