GitHub Advisoryadvisory · RubyGems

GHSA-35j2-p8fh-x966 Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

HIGH Published 2022-05-24 Modified 2023-03-03 Official page ↗
Aliases
CVE-2019-7615
Ecosystem
RubyGems
Packages
elastic-apm
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2023-03-03

Affected packages

• RubyGems elastic-apm: < 2.9.0 → fixed in 2.9.0

Description

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the `server_ca_cert` setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.

Related

Alias · CVE (1)

  • CVE-2019-7615 A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References