The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade icinga2 | May 29, 2025 | May 27, 2025 |
| Suse | — | Upgrade vim-icinga2Upgrade icinga2-docUpgrade icinga2-ido-pgsqlUpgrade icinga2-ido-mysqlUpgrade icinga2-commonUpgrade icinga2-binUpgrade icinga2Upgrade icinga2-libs | Dec 5, 2025 | Aug 13, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub