CVE-2019-7615

Опубликовано: 30 июл. 2019

Источник: nvd

CVSS3: 7.4

CVSS2: 5.8

EPSS Низкий

Описание

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'server_ca_cert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.

Ссылки

https://www.elastic.co/community/security/
Vendor Advisory
https://www.elastic.co/community/security/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:elastic:apm-agent-ruby:*:*:*:*:*:ruby:*:*

Версия до 2.9.0 (исключая)

EPSS

Процентиль: 34%

0.00136

Низкий

7.4 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-35j2-p8fh-x966