Scalyr Agent 2 Missing SSL Certificate Validation

CRITICAL 9.8CVE-2020-24715 · GHSA-738x-v49g-p6hx · PYSEC-2020-252 · Published 27/08/2020 · updated 17/06/2026

In short

CVE-2020-24715 is a CRITICAL (CVSS 9.8) vulnerability affecting scalyr-agent-2, scalyr agent (scalyr).
Chance of exploitation in the next 30 days (EPSS): 0.77%, higher than 55.6% of all vulnerabilities.
Fix: update to 2.1.10 or later.

Package	Affected versions	Patched versions
scalyr-agent-2 PyPI	`< 2.1.10`	`2.1.10`
scalyr agent scalyr	`< 2.1.10`	`2.1.10`

Description

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-24715 · ADVISORY
pypa/advisory-database · WEB
scalyr/scalyr-agent-2 · PACKAGE
scalyr/scalyr-agent-2 · WEB
scalyr-static.s3.amazonaws.com/technical-details/index.html · WEB
web.archive.org/web/20211209045826/https://scalyr-static.s3.amazonaws.com/technical-details/index.html · WEB
GitHub Advisory GHSA-738x-v49g-p6hx · ADVISORY

More vulnerabilities in scalyr-agent-2

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

scalyr-agent-2

PyPI

< 2.1.10

2.1.10

scalyr agent

scalyr

< 2.1.10

2.1.10

Description

NVD description