icinga2 -- Improper access control for JSON-RPC update certificate messages

The Icinga team reports:

The code handling certificate update JSON-RPC messages was flawed and did not properly validate the sender of the message, allowing an unauthenticated attacker that can connect to Icinga 2 to update both the own certificate as well as the trusted CA certificate. Updating the trusted CA allows an attacker to impersonate a trusted node, allowing them to take control over the node.

Any Icinga 2 instance that is accessible to an attacker over the network is affected.

[source]