CVE-2019-7615

Name of the Vulnerable Software and Affected Versions Elastic APM agent for Ruby versions prior to 2.9.0

Description A TLS certificate validation flaw was found in the Elastic APM agent for Ruby. When specifying a trusted server CA certificate via the server ca cert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man-in-the-middle style attack against the Ruby agent.

Recommendations For Elastic APM agent for Ruby versions prior to 2.9.0, update to version 2.9.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the server ca cert setting until a patch is available. Restrict access to the APM server to minimize the risk of exploitation. Avoid using the server ca cert setting in the affected configuration until the issue is resolved.