CVE-2020-24715

Advisory

Scalyr-agent-2 version 2.1.10 includes a fix for CVE-2020-24715: The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

<!---
Packaged by Tomaz Muraus <tomazscalyr.com> on Aug 10, 2020 9:00 -0800
--->

Bug fixes:
* Fix formatting of the "Health Check:" line in ``scalyr-agent-2 status -v`` command output and make sure the value is left padded and consistent with other lines.
* Fix reporting of "Last successful communication with Scalyr" line value in the ``scalyr-agent-2 status -v` command output if we never successfuly establish connection with the Scalyr API.
* Fix a regression in ``scalyr-agent-2-config --upgrade-windows`` functionality which would sometimes throw an exception, depending on the configuration values.

Security fixes and improvments:
* Fix a bug with the agent not correctly validating that the hostname which is stored inside the certificate returned by the server matches the one the agent is trying to connect to (``scalyr_config`` option). This would open up a possibility for MITM attack in case the attacker was able to spoof or control the DNS.
* Fix a bug with the agent not correctly validating the server certificate and hostname when using ``scalyr-agent-2-config --upgrade-windows`` functionality under Python < 2.7.9. This would open up a possibility for MITM attack in case the attacker was able to spoof or control the DNS.
* When connecting to the Scalyr API, agent now explicitly requests TLS v1.2 and aborts connection if the server doesn't support it or tries to use an older version. Recently Scalyr API deprecated support for TLS v1.1 which allows us to implement this change which makes the agent more robust against potential downgrade attacks. Due to lack of required functionality in older Python versions, this is only true when running the agent under Python >= 2.7.9.
* When connecting to the Scalyr API, server now sends a SNI header which matches the host specified in the agent config. Due to lack of required functionality in older Python versions, this is only true when running the agent under Python >= 2.7.9.

Resources

• https://pypi.org/project/scalyr-agent-2
• https://pyup.io/changelogs/scalyr-agent-2/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24715
• https://scalyr-static.s3.amazonaws.com/technical-details/index.html