Lucene search

Veracode Vulnerability DatabaseVERACODE:46686

HistoryApr 30, 2024 - 7:58 a.m.

Improper Certificate Validation

2024-04-3007:58:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

scalyr-agent-2

improper certificate validation

openssl

man-in-the-middle attacks

software

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.003

Percentile

71.0%

JSON

scalyr-agent-2 is vulnerable to Improper Certificate Validation. The vulnerability is due to calling the openssl binary without the -verify_hostname option in some circumstances, which can result in Man-in-the-Middle attacks.

References

github.com/advisories/GHSA-w6xv-mf6f-r5f6

github.com/scalyr/scalyr-agent-2/commit/96d5f5bec734c7a0e7c64654cdb7aacc81fdc867

github.com/scalyr/scalyr-agent-2/releases/tag/v2.1.10

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.003

Percentile

71.0%

JSON

Related for VERACODE:46686