CVE-2023-31421: Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
First published: Thu Oct 26 2023(Updated: )
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.
Credit: bressers@elastic.co
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Elastic Elastic Beats | >=8.0.0<=8.9.2 | |
| Elastic Elastic Agent | >=8.0.0<=8.9.2 | |
| Elastic Apm Server | >=8.0.0<=8.9.2 | |
| Elastic Elastic Fleet Server | >=8.0.0<=8.9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-31421?
CVE-2023-31421 is a vulnerability that affects Beats, Elastic Agent, APM Server, and Fleet Server, allowing for improper certificate validation.
How does the vulnerability in CVE-2023-31421 impact the affected software?
The vulnerability allows for the possibility of the server certificate not being validated for the target IP address.
Which software versions are affected by CVE-2023-31421?
Versions between 8.0.0 and 8.9.2 of Beats, Elastic Agent, APM Server, and Fleet Server are affected by CVE-2023-31421.
What is the severity of CVE-2023-31421?
CVE-2023-31421 has a severity rating of 7.5, which is considered high.
How can I fix the vulnerability in CVE-2023-31421?
To fix the vulnerability, it is recommended to update the affected software to version 8.10.1 or later.
- collector/mitre-cve
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/elastic
- canonical/elastic elastic beats
- version/elastic elastic beats/8.0.0
- version/elastic elastic beats/8.9.2
- canonical/elastic elastic agent
- version/elastic elastic agent/8.0.0
- version/elastic elastic agent/8.9.2
- canonical/elastic apm server
- version/elastic apm server/8.0.0
- version/elastic apm server/8.9.2
- canonical/elastic elastic fleet server
- version/elastic elastic fleet server/8.0.0
- version/elastic elastic fleet server/8.9.2