Reputation
Monthly
Improper certificate validation in multiple Tanium products causes affected installations to continue trusting several intermediate CA certificates whose private keys are known to be compromised, so an unauthenticated network attacker who holds those keys and can intercept traffic could impersonate trusted endpoints with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rates 7.4 High: no privileges or user interaction are needed, but exploitation requires both possession of the compromised intermediate CA keys and a man-in-the-middle position on the network path, which is why complexity is rated High and real-world exploitation is materially constrained. TaniumOS/TanOS, Asset, Comply, Connect, Integrity Monitor, Health Check, Endpoint Configuration Toolset, Patch, Performance and Reputation are all listed as affected; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing).
Sensitive information disclosure in Tanium Reputation allows confidential data handled by the module to be written into Reputation log files, where a party able to read those logs can recover it. Deployments running Reputation 6.6 before 6.6.145, 6.7 before 6.7.138, or 6.8 before 6.8.162 are affected; the assessed vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confines realistic impact to confidentiality loss for an authenticated, highly privileged party that already has log access, rather than to integrity or availability damage. No public exploit code has been identified at time of analysis, and vendor-released patches exist for all three affected branches.
Tanium addressed an improper access controls vulnerability in Reputation. [CVSS 4.3 MEDIUM]
Improper certificate validation in multiple Tanium products causes affected installations to continue trusting several intermediate CA certificates whose private keys are known to be compromised, so an unauthenticated network attacker who holds those keys and can intercept traffic could impersonate trusted endpoints with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rates 7.4 High: no privileges or user interaction are needed, but exploitation requires both possession of the compromised intermediate CA keys and a man-in-the-middle position on the network path, which is why complexity is rated High and real-world exploitation is materially constrained. TaniumOS/TanOS, Asset, Comply, Connect, Integrity Monitor, Health Check, Endpoint Configuration Toolset, Patch, Performance and Reputation are all listed as affected; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing).
Sensitive information disclosure in Tanium Reputation allows confidential data handled by the module to be written into Reputation log files, where a party able to read those logs can recover it. Deployments running Reputation 6.6 before 6.6.145, 6.7 before 6.7.138, or 6.8 before 6.8.162 are affected; the assessed vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confines realistic impact to confidentiality loss for an authenticated, highly privileged party that already has log access, rather than to integrity or availability damage. No public exploit code has been identified at time of analysis, and vendor-released patches exist for all three affected branches.
Tanium addressed an improper access controls vulnerability in Reputation. [CVSS 4.3 MEDIUM]