CVE-2025-48057

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48057
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48057.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-48057
Aliases
  • GHSA-7vcf-f5v9-3wr6
Downstream
Related
Published
2025-05-27T16:32:29.931Z
Modified
2026-07-15T01:28:09.631728Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L CVSS Calculator
Summary
Icinga 2 certificate renewal might incorrectly renew an invalid certificate
Details

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48057.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-296"
    ]
}
References

Affected packages

Git / github.com/icinga/icinga2

Affected ranges

Type
GIT
Repo
https://github.com/icinga/icinga2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a0ec7f6b2fc7d4caa050f7e353e4f53f1bc140b7
Introduced
aaccd0448feff8769b3c825c5c13b9fd6fbeed27
Fixed
ec09daa4a4e7ac400417eb6e3c762bd84bd73f80
Introduced
0d5802937ba274fd3b9e13a48c4638cc104ad577
Fixed
e4d2788f0869808bccea67a041a347c4c6bc237b
Fixed
34c93a2542bbe4e9886d15bc17ec929ead1aa152
Fixed
4023128be42b18a011dda71ddee9ca79955b89cb
Fixed
60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776
Fixed
9ad5683aab9eb392c6737ff46c830a945c9e240f
Fixed
9b2c05d0cc09210bdeade77cf9a73859250fc48d
Database specific 
{
    "cpe": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.12.12"
        },
        {
            "introduced": "2.13.0"
        },
        {
            "fixed": "2.13.12"
        },
        {
            "introduced": "2.14.0"
        },
        {
            "fixed": "2.14.6"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v2.*
v2.0.0
v2.0.0-beta1
v2.0.0-beta2
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.11.0
v2.11.0-rc1
v2.12.0
v2.12.0-rc1
v2.12.1
v2.12.10
v2.12.2
v2.12.3
v2.12.4
v2.12.7
v2.12.8
v2.12.9
v2.13.0
v2.13.11
v2.13.2
v2.13.3
v2.13.4
v2.13.5
v2.13.6
v2.13.7
v2.13.8
v2.13.9
v2.14.0
v2.14.1
v2.14.2
v2.14.4
v2.14.5
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.9.0

Database specific

vanir_signatures_modified 
"2026-07-15T01:28:09Z"
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48057.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.hpp"
        },
        "digest": {
            "line_hashes": [
                "3491198302896617585895640052757065229",
                "303060401776173714077431385650847764324",
                "220532547816485816318951536448116475112",
                "321233612568751373398374855837942633556"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/34c93a2542bbe4e9886d15bc17ec929ead1aa152",
        "id": "CVE-2025-48057-014e35b1"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.hpp"
        },
        "digest": {
            "line_hashes": [
                "304032852258438299204190638113903384479",
                "17011208775702881136301103551039566400",
                "207248530166965759162778362562990506458",
                "175359461357258844172864058395312339308"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776",
        "id": "CVE-2025-48057-0836a508"
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp",
            "function": "CertificateToString"
        },
        "digest": {
            "function_hash": "322855558969619336845962472735346320862",
            "length": 246.0
        },
        "source": "https://github.com/icinga/icinga2/commit/34c93a2542bbe4e9886d15bc17ec929ead1aa152",
        "id": "CVE-2025-48057-0fb93e3b"
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp",
            "function": "VerifyCertificate"
        },
        "digest": {
            "function_hash": "28312077791027138811142892524984131119",
            "length": 784.0
        },
        "source": "https://github.com/icinga/icinga2/commit/4023128be42b18a011dda71ddee9ca79955b89cb",
        "id": "CVE-2025-48057-171e81f4"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "159276653857510602167360890960314713263",
                "61809480517327472807121732760760144516",
                "169025674566987367843193611056704110909",
                "326071338543853958978057726419168424282",
                "182928321914928301877503968677573989551",
                "22665016523157241392737212903747392250",
                "40154281354843637692001173712656175219",
                "226792325827060607972331373100315469227",
                "109752335176638966391649819400631928687",
                "259546338518431653728384731322351926888",
                "247389689158375244856204863364790965771",
                "67047400775005785698826958284978894111",
                "204290237326312308905957982480369826140"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776",
        "id": "CVE-2025-48057-255e792e"
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp",
            "function": "VerifyCertificate"
        },
        "digest": {
            "function_hash": "28312077791027138811142892524984131119",
            "length": 784.0
        },
        "source": "https://github.com/icinga/icinga2/commit/9ad5683aab9eb392c6737ff46c830a945c9e240f",
        "id": "CVE-2025-48057-2baaef3d"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "159276653857510602167360890960314713263",
                "61809480517327472807121732760760144516",
                "169025674566987367843193611056704110909",
                "326071338543853958978057726419168424282",
                "182928321914928301877503968677573989551",
                "22665016523157241392737212903747392250",
                "40154281354843637692001173712656175219",
                "226792325827060607972331373100315469227",
                "109752335176638966391649819400631928687",
                "259546338518431653728384731322351926888",
                "247389689158375244856204863364790965771",
                "67047400775005785698826958284978894111",
                "204290237326312308905957982480369826140"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/4023128be42b18a011dda71ddee9ca79955b89cb",
        "id": "CVE-2025-48057-51414640"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.hpp"
        },
        "digest": {
            "line_hashes": [
                "270611667934833254258011684407575543989",
                "324138739013808535349960580040215915093",
                "79438278102718553861593300493390820400",
                "175359461357258844172864058395312339308"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/9b2c05d0cc09210bdeade77cf9a73859250fc48d",
        "id": "CVE-2025-48057-5188ebcf"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "test/base-tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "264039867849345771836117289311014090621"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776",
        "id": "CVE-2025-48057-878107ea"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "37628250000458483339563303831004754647",
                "61809480517327472807121732760760144516",
                "169025674566987367843193611056704110909",
                "326071338543853958978057726419168424282",
                "182928321914928301877503968677573989551",
                "22665016523157241392737212903747392250",
                "40154281354843637692001173712656175219",
                "226792325827060607972331373100315469227",
                "109752335176638966391649819400631928687",
                "259546338518431653728384731322351926888",
                "247389689158375244856204863364790965771",
                "67047400775005785698826958284978894111",
                "204290237326312308905957982480369826140"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/9b2c05d0cc09210bdeade77cf9a73859250fc48d",
        "id": "CVE-2025-48057-9ca86986"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "168094927706988865341692166046166022501",
                "318051998536232957972707186435995378788",
                "165252239837854631296236630125231759285",
                "96671122252136923098924184218718468507",
                "132490326572475438788101597351060005810",
                "82868455693684136536493689524390487988",
                "136506921229919231004318045351112581960"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/34c93a2542bbe4e9886d15bc17ec929ead1aa152",
        "id": "CVE-2025-48057-abc893f5"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.hpp"
        },
        "digest": {
            "line_hashes": [
                "304032852258438299204190638113903384479",
                "17011208775702881136301103551039566400",
                "207248530166965759162778362562990506458",
                "175359461357258844172864058395312339308"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/4023128be42b18a011dda71ddee9ca79955b89cb",
        "id": "CVE-2025-48057-bc7ddf03"
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp",
            "function": "VerifyCertificate"
        },
        "digest": {
            "function_hash": "28312077791027138811142892524984131119",
            "length": 784.0
        },
        "source": "https://github.com/icinga/icinga2/commit/9b2c05d0cc09210bdeade77cf9a73859250fc48d",
        "id": "CVE-2025-48057-c650dbef"
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp",
            "function": "VerifyCertificate"
        },
        "digest": {
            "function_hash": "28312077791027138811142892524984131119",
            "length": 784.0
        },
        "source": "https://github.com/icinga/icinga2/commit/60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776",
        "id": "CVE-2025-48057-d1d61e2d"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "test/base-tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "264039867849345771836117289311014090621"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/9ad5683aab9eb392c6737ff46c830a945c9e240f",
        "id": "CVE-2025-48057-dd500fd0"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "159276653857510602167360890960314713263",
                "61809480517327472807121732760760144516",
                "169025674566987367843193611056704110909",
                "326071338543853958978057726419168424282",
                "182928321914928301877503968677573989551",
                "22665016523157241392737212903747392250",
                "40154281354843637692001173712656175219",
                "226792325827060607972331373100315469227",
                "109752335176638966391649819400631928687",
                "259546338518431653728384731322351926888",
                "247389689158375244856204863364790965771",
                "67047400775005785698826958284978894111",
                "204290237326312308905957982480369826140"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/9ad5683aab9eb392c6737ff46c830a945c9e240f",
        "id": "CVE-2025-48057-e49cb302"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "lib/base/tlsutility.hpp"
        },
        "digest": {
            "line_hashes": [
                "304032852258438299204190638113903384479",
                "17011208775702881136301103551039566400",
                "207248530166965759162778362562990506458",
                "175359461357258844172864058395312339308"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/9ad5683aab9eb392c6737ff46c830a945c9e240f",
        "id": "CVE-2025-48057-f0a205b4"
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "test/base-tlsutility.cpp"
        },
        "digest": {
            "line_hashes": [
                "264039867849345771836117289311014090621"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/icinga/icinga2/commit/4023128be42b18a011dda71ddee9ca79955b89cb",
        "id": "CVE-2025-48057-f2bf14ca"
    }
]