CVE-2020-29663: 
Icinga vulnerability analysis and mitigation

Icinga 2, a network monitoring system, versions v2.8.0 through v2.11.7 and v2.12.2 contained a certificate validation vulnerability where revoked certificates due for renewal would automatically be renewed while ignoring the Certificate Revocation List (CRL). This vulnerability was discovered and disclosed in December 2020, and was subsequently fixed in versions v2.11.8 and v2.12.3 (Icinga Advisory).

The vulnerability (CVE-2020-29663) stems from an implementation flaw in the ApiListener configuration where the CRL was only checked during connection establishment but not during certificate renewal processes. This oversight allowed nodes to automatically renew revoked certificates if they met other renewal conditions, specifically if they were issued before 2017 or were expiring within 30 days. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and is classified under CWE-295 (Improper Certificate Validation) (NVD).

The vulnerability primarily affects setups with external certificate signing and revoked certificates that are approaching expiration (within 30 days). Given that Icinga 2 uses a validity duration of 15 years for certificates, the impact was somewhat limited to specific deployment scenarios. However, in affected systems, this could potentially allow unauthorized certificate renewal, bypassing intended security controls (Icinga Advisory).

The vulnerability requires no special privileges or user interaction to exploit, as indicated by the CVSS metrics (AV:N/AC:L/PR:N/UI:N). However, it specifically affects scenarios where external certificate signing is in use and certificates have been revoked (NVD).

The vulnerability was addressed in Icinga 2 versions v2.11.8 and v2.12.3. Users of affected versions should upgrade to these patched versions or later releases. The fix ensures proper CRL checking during certificate renewal processes (Icinga Advisory).