elastic/apm-agent-ruby · Security
Elastic APM agent for Ruby vulnerable to Improper Certificate Validation
- GHSA ID
- GHSA-35j2-p8fh-x966
- CVE ID
- CVE-2019-7615
- Severity
- high
- Published
- Updated
- CVSS
- 7.4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS v3
- 7.4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the server_ca_cert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.
CWEs
- CWE-295 · Improper Certificate Validation