Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-37682 State: PUBLISHED Published: 2021-08-12T22:45:12 Last Updated: 2024-08-04T01:23:01.529Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-908 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc#L198-L200). The issue stems from the fact that `quantization.params` is only valid if `quantization.type` is different tha
98-L200). The issue stems from the fact that `quantization.params` is only valid if `quantization.type` is different that `kTfLiteNoQuantization`. However, these checks are missing in large parts of the code. We have patched the issue in GitHub commits 537bc7c723439b9194a358f64d871dd326c18887, 4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 and 8933b8a21280696ab119b63263babdb54c298538. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/adv
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4c4g-crqm-xrxw - https://github.com/tensorflow/tensorflow/commit/4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 - https://github.com/tensorflow/tensorflow/commit/537bc7c723439b9194a358f64d871dd326c18887 - https://github.com/tensorflow/tensorflow/commit/8933b8a21280696ab119b63263babdb54c298538
CVE ID: CVE-2021-37683 State: PUBLISHED Published: 2021-08-12T22:30:23 Last Updated: 2024-08-04T01:23:01.436Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-369 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is [vulnerable to a division by 0 error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/div.cc). There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab
divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rhrq-64mq-hf9h - https://github.com/tensorflow/tensorflow/commit/1e206baedf8bef0334cca3eb92bab134ef525a28
CVE ID: CVE-2021-37684 State: PUBLISHED Published: 2021-08-12T22:30:17 Last Updated: 2024-08-04T01:23:01.504Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-369 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695). The fix will be included in TensorFlow 2.6
b.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q7f7-544h-67h9
CVE ID: CVE-2021-37685 State: PUBLISHED Published: 2021-08-12T22:15:10 Last Updated: 2024-08-04T01:23:01.547Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`expand_dims.cc`](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/expand_dims.cc#L36-L50) contains a vulnerability which allows reading one element outside of bounds of heap allocated data. If `axis` is a large negative value (e.g., `-100000`), then after the first `if` it w
of bounds of heap allocated data. If `axis` is a large negative value (e.g., `-100000`), then after the first `if` it would still be negative. The check following the `if` statement will pass and the `for` loop would read one element before the start of `input_dims.data` (when `i = 0`). We have patched the issue in GitHub commit d94ffe08a65400f898241c0374e9edc6fa8ed257. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/
onal Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c545-c4f9-rf6v - https://github.com/tensorflow/tensorflow/commit/d94ffe08a65400f898241c0374e9edc6fa8ed257
CVE ID: CVE-2021-37686 State: PUBLISHED Published: 2021-08-12T21:55:11 Last Updated: 2024-11-13T21:20:48.849Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-835 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definition](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/strided_slice.cc#L103-L122). An attacker can
flow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/strided_slice.cc#L103-L122). An attacker can craft a model such that `ellipsis_end_idx` is smaller than `i` (e.g., always negative). In this case, the inner loop does not increase `i` and the `continue` statement causes execution to skip over the preincrement at the end of the outer loop. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. TensorFlow 2.6.0 is the only affected version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mhhc-q96p-mfm9 - https://github.com/tensorflow/tensorflow/commit/dfa22b3
/tensorflow/tensorflow/security/advisories/GHSA-mhhc-q96p-mfm9 - https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695
CVE ID: CVE-2021-37687 State: PUBLISHED Published: 2021-08-12T22:15:17 Last Updated: 2024-08-04T01:23:01.653Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`GatherNd` implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/gather_nd.cc#L124) does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative va
this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in `indices`. Similar issue exists in [`Gather` implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/gather.cc). We have patched the issue in GitHub commits bb6a0383ed553c286f87ca88c207f6774d5c4a8f and eb921122119a6b6e470ee98b89e65d721663179d. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: Refere
.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jwf9-w5xm-f437 - https://github.com/tensorflow/tensorflow/commit/bb6a0383ed553c286f87ca88c207f6774d5c4a8f - https://github.com/tensorflow/tensorflow/commit/eb921122119a6b6e470ee98b89e65d721663179d
CVE ID: CVE-2021-37688 State: PUBLISHED Published: 2021-08-12T22:00:12 Last Updated: 2024-08-04T01:23:01.508Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L268-L285) unconditionally dereferences a poin
c41d005b81082a/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L268-L285) unconditionally dereferences a pointer. We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vcjj-9vg7-vf68 - https://github.com/tensorflow/tensorflow/commit/15691e456c7dc9bd6be203b09765b063bf4a380c
CVE ID: CVE-2021-37689 State: PUBLISHED Published: 2021-08-12T22:00:19 Last Updated: 2024-08-04T01:23:01.451Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. This is caused by the MLIR optimization of `L2NormalizeReduceAxis` operator. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/compiler/mlir/lit
ion](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/compiler/mlir/lite/transforms/optimize.cc#L67-L70) unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements. We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wf5p-c75w-w3wh -
CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wf5p-c75w-w3wh - https://github.com/tensorflow/tensorflow/commit/d6b57f461b39fd1aa8c1b870f1b974aac3554955
CVE ID: CVE-2021-37690 State: PUBLISHED Published: 2021-08-12T23:10:16 Last Updated: 2024-08-04T01:23:01.511Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-416 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions when running shape functions, some functions (such as `MutableHashTableShape`) produce extra output information in the form of a `ShapeAndType` struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfaul
cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault. `ShapeRefiner` is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types. We have patched the issue in GitHub commit ee119d4a498979525046fba1c3dd3f13a039fbb1. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in suppo
k this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3hxh-8cp2-g4hg - https://github.com/tensorflow/tensorflow/commit/ee119d4a498979525046fba1c3dd3f13a039fbb1
CVE ID: CVE-2021-37691 State: PUBLISHED Published: 2021-08-12T22:25:11 Last Updated: 2024-08-04T01:23:01.519Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-369 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a division by zero error in LSH [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/lsh_projection.cc#L118). We have patched the issue in GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9. The fix will be includ
on.cc#L118). We have patched the issue in GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-27qf-jwm8-g7f3 - https://github.com/tensorflow/tensorflow/commit/0575b640091680cfb70f4dd93e70658de43b94f9
CVE ID: CVE-2021-37692 State: PUBLISHED Published: 2021-08-12T23:00:14 Last Updated: 2024-08-04T01:23:01.419Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string deallocation. For string tensors, `C.TF_TString_Dealloc` is called during garbage collection within a finalizer function. However, tensor structure isn't checked until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfa
until encoding to avoid a performance penalty. The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions). To fix this, the call to set the finalizer function is deferred until `NewTensor` returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written. We have patched the issue in GitHub commit 8721ba96e5760c229217b594f6d2ba332beedf22. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version. Additional Analyst Notes: - CVE Program Container: References: -
TensorFlow 2.5.1, which is the other affected version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cmgw-8vpc-rc59 - https://github.com/tensorflow/tensorflow/pull/50508 - https://github.com/tensorflow/tensorflow/commit/8721ba96e5760c229217b594f6d2ba332beedf22
CVE ID: CVE-2021-37693 State: PUBLISHED Published: 2021-08-13T15:15:10 Last Updated: 2024-08-04T01:23:01.468Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-640, CWE-613 Description: Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password. Additional Analyst
t invalidate an unused token which can then be used in other contexts, including reseting a password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-9377-96f4-cww4 - https://github.com/discourse/discourse/commit/fb14e50741a4880cda22244eded8858e2f5336ef
CVE ID: CVE-2021-37694 State: PUBLISHED Published: 2021-08-11T17:25:09 Last Updated: 2024-08-04T01:23:01.532Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: asyncapi Products: java-spring-cloud-stream-template Problem Types: CWE-94 Description: @asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and all users are advised to update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/asyncapi
sers are advised to update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/asyncapi/java-spring-cloud-stream-template/security/advisories/GHSA-xj6r-2jpm-qvxp
CVE ID: CVE-2021-37695 State: PUBLISHED Published: 2021-08-12T23:10:10 Last Updated: 2024-08-04T01:23:01.506Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: ckeditor Products: ckeditor4 Problem Types: CWE-79 Description: ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched.
s all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc - https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ - https://lists.fedoraproject.org/arch
kage-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-37696 State: PUBLISHED Published: 2021-08-11T22:55:09 Last Updated: 2024-08-04T01:23:01.525Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: tmercswims Products: tmerc-cogs Problem Types: CWE-306 Description: tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific MassDM message. Issue is patched in commit 92325be650a6c17940cc52611797533ed95dbbe1. All users are advised to update to the current commit. As a workaround users may unload the MassDM cog or globally disable the `[p]massdm` command. Additional Ana
rent commit. As a workaround users may unload the MassDM cog or globally disable the `[p]massdm` command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tmercswims/tmerc-cogs/security/advisories/GHSA-ffhm-9c8j-wx9h - https://github.com/tmercswims/tmerc-cogs/commit/92325be650a6c17940cc5
CVE ID: CVE-2021-37697 State: PUBLISHED Published: 2021-08-11T23:00:11 Last Updated: 2024-08-04T01:23:01.476Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: tmercswims Products: tmerc-cogs Problem Types: CWE-306 Description: tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific membership event message. Issue is patched in commit d63c49b4cfc30c795336e4fff08cba3795e0fcc0. As a workaround users may unload the Welcome cog. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tmercswims/tmerc-c
the Welcome cog. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tmercswims/tmerc-cogs/security/advisories/GHSA-77xv-8c2x-j96j - https://github.com/tmercswims/tmerc-cogs/commit/d63c49b4cfc30c795336e4fff08cba3795e0fcc0
CVE ID: CVE-2021-37698 State: PUBLISHED Published: 2021-08-19T13:55:10.000Z Last Updated: 2025-11-03T21:45:10.788Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Icinga Products: icinga2 Problem Types: CWE-295 Description: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS ov
ity being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2 - https://github.com/Icinga/icinga2/releases/tag/v2.11.11 - https://github.com/Icinga/icinga2/releases/tag/v2.12.6 - https://github.com/Icinga/icinga2/rel
2/releases/tag/v2.11.11 - https://github.com/Icinga/icinga2/releases/tag/v2.12.6 - https://github.com/Icinga/icinga2/releases/tag/v2.13.1 - https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html