Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

HIGH 7.4CVE-2019-7615 · GHSA-35j2-p8fh-x966 · Published 30/07/2019 · updated 17/06/2026

In short

CVE-2019-7615 is a HIGH (CVSS 7.4) vulnerability affecting elastic-apm, apm-agent-ruby (elastic).
Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 50.9% of all vulnerabilities.
Fix: update to 2.9.0 or later.

Package	Affected versions	Patched versions
elastic-apm RubyGems	`< 2.9.0`	`2.9.0`
apm-agent-ruby elastic	`< 2.9.0`	`2.9.0`

Description

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the server_ca_cert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.

NVD description

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'server_ca_cert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.

References

nvd.nist.gov/vuln/detail/CVE-2019-7615 · ADVISORY
elastic/apm-agent-ruby#449 · WEB
elastic/apm-agent-ruby · PACKAGE
rubysec/ruby-advisory-db · WEB
elastic.co/community/security · WEB
elastic.co/community/security · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

elastic-apm

RubyGems

< 2.9.0

2.9.0

apm-agent-ruby

elastic

< 2.9.0

2.9.0

Description

NVD description