NVD Vulnerability Detail

CVE-2024-49369

Summary	Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
Publication Date	Nov. 13, 2024, 2:15 a.m.
Registration Date	Nov. 13, 2024, 5:01 a.m.
Last Update	Nov. 14, 2024, 2:01 a.m.

Related information, measures and tools

No	URL	refsource	タグ
1	https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv
2	https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c
3	https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8
4	https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe
5	https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6
6	https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831
7	https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-295	不正な証明書検証	https://cwe.mitre.org/data/definitions/295.html

JVN Vulnerability Information

Icinga GmbH の Icinga 等複数ベンダの製品における証明書検証に関する脆弱性

Title	Icinga GmbH の Icinga 等複数ベンダの製品における証明書検証に関する脆弱性
Summary	Icinga GmbH の Icinga 等複数ベンダの製品には、証明書検証に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	Nov. 12, 2024, midnight
Registration Date	Nov. 28, 2025, 2 p.m.
Last Update	Nov. 28, 2025, 2 p.m.

Affected System

Debian

Debian GNU/Linux 11.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2024-49369	https://www.cve.org/CVERecord?id=CVE-2024-49369
National Vulnerability Database (NVD)
2	CVE-2024-49369	https://nvd.nist.gov/vuln/detail/CVE-2024-49369

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-295	https://cwe.mitre.org/data/definitions/295.html

その他

No	Name	URL
関連文書
1	github.com (0419a2c36de408e9a703aec0962061ec9a285d3c)	https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c
2	github.com (2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8)	https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8
3	github.com (3504fc7ed688c10d86988e2029a65efc311393fe)	https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe
4	github.com (869a7d6f0fe38c748e67bacc1fbdd42c933030f6)	https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6
5	github.com (8fed6608912c752b337d977f730547875a820831)	https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831
6	github.com (GHSA-j7wq-r9mg-9wpv)	https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv
7	icinga.com (critical-icinga-2-security-releases-2-14-3)	https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3
8	lists.debian.org (msg00010)	https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html

Change Log

No	Changed Details	Date of change
1	[2025年11月28日] 掲載	Nov. 28, 2025, 2 p.m.