CVE-2024-28872
Incorrect TLS certificate validation can lead to escalated privileges
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Incorrect TLS certificate validation can lead to escalated privileges
The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service (Kea or BIND 9), possibly resulting in confidential data loss and/or denial of service. It should be noted that this vulnerability is not related to BIND 9 or Kea directly, and only customers using the Stork management tool are potentially affected. This issue affects Stork versions 0.15.0 through 1.15.0.
Reserved 2024-03-12 | Published 2024-07-11 | Updated 2025-03-26 | Assigner isckb.isc.org/docs/cve-2024-28872 (CVE-2024-28872)
Support options
