Test ID:	1.3.6.1.4.1.25623.1.0.149405
Category:	General
Title:	Check MK 1.6.x < 2.2.0b1, 2.3.x < 2.3.0b1 Certification Validation Vulnerability
Summary:	Check MK is prone to a certification validation vulnerability.
Description:	Summary: Check MK is prone to a certification validation vulnerability. Vulnerability Insight: The compiled version of the agent-updater uses its own collection of trusted Certificate Authorities. This collection comes from the Python package certifi and is based on the collection of Mozilla Firefox. The used Python package and therefore the collection was outdated and is subject to CVE-2022-23491. This collection included a CA certificate of TrustCor which is not considered trustworthy anymore. Vulnerability Impact: If an attacker is able to create certificates for arbitrary domains signed by this CA, machine-in-the-middle attacks could be possible. Affected Software/OS: Check MK version 1.6.x prior to 2.2.0b1 and 2.3.x prior to 2.3.0b1. Solution: Update to version 2.2.0b1, 2.3.0b1 or later. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-23491 https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.