CVE-2021-37698

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.

• CWE-295
• CWE-295

• https://github.com/Icinga/icinga2/releases/tag/v2.11.11Release Notes, Third Party Advisory
• https://github.com/Icinga/icinga2/releases/tag/v2.12.6Release Notes, Third Party Advisory
• https://github.com/Icinga/icinga2/releases/tag/v2.13.1Release Notes, Third Party Advisory
• https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00010.htmlMailing List, Third Party Advisory
• https://github.com/Icinga/icinga2/releases/tag/v2.11.11Release Notes, Third Party Advisory
• https://github.com/Icinga/icinga2/releases/tag/v2.12.6Release Notes, Third Party Advisory
• https://github.com/Icinga/icinga2/releases/tag/v2.13.1Release Notes, Third Party Advisory
• https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html

Published

Aug 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37692TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37693Discourse is an open-source platform for community discussio…7.5
• CVE-2021-37694@asyncapi/java-spring-cloud-stream-template generates a Spri…7.8
• CVE-2021-37695ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-37696tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37697tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37699Next.js is an open source website development framework to b…6.1
• CVE-2021-3770vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-37700@github/paste-markdown is an npm package for pasting markdow…6.1
• CVE-2021-37701The npm package "tar" (aka node-tar) before versions 4.4.16,…8.6
• CVE-2021-37702Pimcore is an open source data & experience management platf…8.8
• CVE-2021-37703Discourse is an open-source platform for community discussio…4.3