CVE-2025-48057: Icinga 2 certificate renewal might incorrectly renew an invalid certificate
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48057?
CVE-2025-48057 is classified as a medium severity vulnerability.
How do I fix CVE-2025-48057?
To fix CVE-2025-48057, upgrade Icinga 2 to version 2.12.12, 2.13.12, or 2.14.6.
Which versions of Icinga 2 are affected by CVE-2025-48057?
CVE-2025-48057 affects Icinga 2 versions prior to 2.12.12, 2.13.12, and 2.14.6.
Which versions of OpenSSL are affected by CVE-2025-48057?
CVE-2025-48057 affects OpenSSL versions prior to 1.1.0.
What is the impact of CVE-2025-48057 on Icinga 2?
CVE-2025-48057 could allow for improper handling of SSL certificates within Icinga 2, potentially leading to security bypass.