{
  "GSD": {
    "alias": "CVE-2021-32739",
    "description": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user\u0027s credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node\u0027s certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user\u0027s identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.",
    "id": "GSD-2021-32739",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-32739.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-32739"
      ],
      "details": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user\u0027s credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node\u0027s certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user\u0027s identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.",
      "id": "GSD-2021-32739",
      "modified": "2023-12-13T01:23:09.275043Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-32739",
        "STATE": "PUBLIC",
        "TITLE": "Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "icinga2",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 2.4.0, \u003c= 2.12.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Icinga"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user\u0027s credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node\u0027s certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user\u0027s identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-267: Privilege Defined With Unsafe Actions"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5",
            "refsource": "CONFIRM",
            "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5"
          },
          {
            "name": "https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/",
            "refsource": "MISC",
            "url": "https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/"
          },
          {
            "name": "[debian-lts-announce] 20211110 [SECURITY] [DLA 2816-1] icinga2 security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-98wp-jc6q-x5q5",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.11.10",
                "versionStartIncluding": "2.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.12.5",
                "versionStartIncluding": "2.12.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-32739"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user\u0027s credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node\u0027s certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user\u0027s identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-267"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/",
              "refsource": "MISC",
              "tags": [
                "Broken Link",
                "Vendor Advisory"
              ],
              "url": "https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/"
            },
            {
              "name": "https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5"
            },
            {
              "name": "[debian-lts-announce] 20211110 [SECURITY] [DLA 2816-1] icinga2 security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-12-03T02:39Z",
      "publishedDate": "2021-07-15T15:15Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Icinga ist ein Monitoring System.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Icinga ausnutzen, um seine Privilegien zu erh\u00f6hen und vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3477 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2024-3477.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3477 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3477"
      },
      {
        "category": "external",
        "summary": "Github Icinga vom 2021-07-15",
        "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7"
      },
      {
        "category": "external",
        "summary": "Github Icinga vom 2021-07-15",
        "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-2816 vom 2021-11-10",
        "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3953 vom 2024-11-16",
        "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Icinga: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-11-17T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-18T09:05:54.524+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-3477",
      "initial_release_date": "2021-07-15T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2021-07-15T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2021-11-10T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2024-11-17T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Debian aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.11.10",
                "product": {
                  "name": "Open Source Icinga \u003c2.11.10",
                  "product_id": "T019828"
                }
              },
              {
                "category": "product_version",
                "name": "2.11.10",
                "product": {
                  "name": "Open Source Icinga 2.11.10",
                  "product_id": "T019828-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:icinga:icinga:2.11.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.12.5",
                "product": {
                  "name": "Open Source Icinga \u003c2.12.5",
                  "product_id": "T019829"
                }
              },
              {
                "category": "product_version",
                "name": "2.12.5",
                "product": {
                  "name": "Open Source Icinga 2.12.5",
                  "product_id": "T019829-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:icinga:icinga:2.12.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Icinga"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-32739",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Icinga. Der Fehler besteht, weil es m\u00f6glich ist, die Identit\u00e4t eines Endpunkts oder eines API-Benutzers durch Senden speziell gestalteter Abfragen an \"ApiListener\"-Objekte zu erhalten. Ein entfernter authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T019829",
          "T019828"
        ]
      },
      "release_date": "2021-07-15T22:00:00.000+00:00",
      "title": "CVE-2021-32739"
    },
    {
      "cve": "CVE-2021-32743",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Icinga. Der Fehler besteht in den Objekttypen von \"IdoMysqlConnection\" und \"IdoPgsqlConnection\" durch das Senden speziell gestalteter Anfragen. Ein entfernter authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T019829",
          "T019828"
        ]
      },
      "release_date": "2021-07-15T22:00:00.000+00:00",
      "title": "CVE-2021-32743"
    }
  ]
}