CVE catalog

CVE-2024-49369

icinga2: CVE-2024-49369

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.92% · Oct 25, 2026

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianicinga2sid2.16.5-1fixed
Debianicinga2forky2.16.5-1fixed
Debianicinga2trixie2.14.6-1fixed
Debianicinga2trixie-security2.14.6-1+deb13u1fixed
Debianicinga2bookworm2.13.6-2+deb12u2fixed
Opensuseicinga2tumbleweed2.14.3-1.1fixed
Suseicinga2package hub 15 sp62.13.10-bp156.4.3.1fixed
Opensuseicinga2leap 15.62.13.10-bp156.4.3.1fixed
Suseicinga2package hub 15 sp52.13.10-bp155.3.3.1fixed
Opensuseicinga2leap 15.52.13.10-bp155.3.3.1fixed
Ubuntuicinga216.042.3.8-1build1vulnerable
Ubuntuicinga216.042.3.11-1vulnerable
Ubuntuicinga216.042.4.0-1vulnerable
Ubuntuicinga216.042.4.1-1vulnerable
Ubuntuicinga216.042.4.1-2vulnerable
Ubuntuicinga216.042.4.1-2ubuntu1vulnerable
Ubuntuicinga218.042.7.0-1vulnerable
Ubuntuicinga218.042.8.1-0ubuntu2vulnerable
Ubuntuicinga220.042.10.5-1build1vulnerable
Ubuntuicinga220.042.11.2-1vulnerable
Ubuntuicinga220.042.11.2-1ubuntu1vulnerable
Ubuntuicinga220.042.11.2-1ubuntu2vulnerable
Ubuntuicinga220.042.11.2-1ubuntu3vulnerable
Ubuntuicinga222.042.12.3-1vulnerable
Ubuntuicinga222.042.13.1-1vulnerable
Ubuntuicinga222.042.13.2-1vulnerable
Ubuntuicinga222.042.13.2-1build1vulnerable
Ubuntuicinga222.042.13.2-1build2vulnerable
Ubuntuicinga224.042.13.8-1vulnerable
Ubuntuicinga224.042.14.1-1vulnerable
Ubuntuicinga224.042.14.2-1vulnerable
Ubuntuicinga224.042.14.2-1build1vulnerable
Ubuntuicinga224.042.14.2-1build2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianicinga2sourcesid2.14.3-1not yet assignedNot reported[1087384]
Debianicinga2sourceforky2.14.3-1not yet assignedNot reported[1087384]
Debianicinga2sourcetrixie2.14.3-1not yet assignedNot reported[1087384]
Debianicinga2sourcebookworm2.13.6-2+deb12u2not yet assignedNot reported[1087384]
Opensuseicinga2rpmtumbleweed2.14.3-1.1Not reportedOPENSUSE-SU-2024:14493-1Not reported
Suseicinga2rpmpackage hub 15 sp62.13.10-bp156.4.3.1Not reportedOPENSUSE-SU-2024:0372-1Not reported
Opensuseicinga2rpmleap 15.62.13.10-bp156.4.3.1Not reportedOPENSUSE-SU-2024:0372-1Not reported
Suseicinga2rpmpackage hub 15 sp52.13.10-bp155.3.3.1Not reportedOPENSUSE-SU-2024:0371-1Not reported
Opensuseicinga2rpmleap 15.52.13.10-bp155.3.3.1Not reportedOPENSUSE-SU-2024:0371-1Not reported

[Debian bug #1087384]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [icinga2-bin]Unknown

    Source package: [icinga2]

    Details (1)

    • 2.16.5-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.3-1.1

      Version impact unknown

      dsa · icinga2 · opensuse · tumbleweed

  • [icinga2-common]Unknown

    Source package: [icinga2]

    Details (1)

    • 2.16.5-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.3-1.1

      Version impact unknown

      dsa · icinga2 · opensuse · tumbleweed

  • [icinga2-doc]Unknown

    Source package: [icinga2]

    Details (1)

    • 2.16.5-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.3-1.1

      Version impact unknown

      dsa · icinga2 · opensuse · tumbleweed

  • [icinga2-ido-mysql]Unknown

    Source package: [icinga2]

    Details (1)

    • 2.16.5-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.3-1.1

      Version impact unknown

      dsa · icinga2 · opensuse · tumbleweed

  • [icinga2-ido-pgsql]Unknown

    Source package: [icinga2]

    Details (1)

    • 2.16.5-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.3-1.1

      Version impact unknown

      dsa · icinga2 · opensuse · tumbleweed

  • [nano-icinga2]Unknown

    Source package: [icinga2]

    Details (1)

    • 2.16.5-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.3-1.1

      Version impact unknown

      dsa · icinga2 · opensuse · tumbleweed

  • [vim-icinga2]Unknown

    Source package: [icinga2]

    Details (1)

    • 2.16.5-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.3-1.1

      Version impact unknown

      dsa · icinga2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [icinga2]Fixed
    Details (2)

    • 2.13.6-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

    • 2.13.6-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

  • [icinga2-bin]Fixed

    Source package: [icinga2]

    Details (2)

    • 2.13.6-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

    • 2.13.6-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

  • [icinga2-common]Fixed

    Source package: [icinga2]

    Details (2)

    • 2.13.6-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

    • 2.13.6-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

  • [icinga2-doc]Fixed

    Source package: [icinga2]

    Details (2)

    • 2.13.6-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

    • 2.13.6-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

  • [icinga2-ido-mysql]Fixed

    Source package: [icinga2]

    Details (2)

    • 2.13.6-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

    • 2.13.6-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

  • [icinga2-ido-pgsql]Fixed

    Source package: [icinga2]

    Details (2)

    • 2.13.6-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

    • 2.13.6-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

  • [vim-icinga2]Fixed

    Source package: [icinga2]

    Details (2)

    • 2.13.6-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

    • 2.13.6-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.13.6-2+deb12u2

      dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

[Debian 13 (Trixie)]

  • [icinga2]Fixed
    Details (4)

    • 2.14.6-1 · amd64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1 · arm64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

  • [icinga2-bin]Fixed

    Source package: [icinga2]

    Details (4)

    • 2.14.6-1 · amd64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1 · arm64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

  • [icinga2-common]Fixed

    Source package: [icinga2]

    Details (4)

    • 2.14.6-1 · all · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1 · all · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

  • [icinga2-doc]Fixed

    Source package: [icinga2]

    Details (4)

    • 2.14.6-1 · all · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1 · all · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

  • [icinga2-ido-mysql]Fixed

    Source package: [icinga2]

    Details (4)

    • 2.14.6-1 · amd64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1 · arm64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

  • [icinga2-ido-pgsql]Fixed

    Source package: [icinga2]

    Details (4)

    • 2.14.6-1 · amd64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1 · arm64 · trixie

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

    • 2.14.6-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.14.3-1

      dsa · icinga2 · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]