CVE-2020-15719

Опубликовано: 14 июл. 2020

Источник: nvd

CVSS3: 4.2

CVSS2: 4

EPSS Низкий

Описание

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:3674
Third Party Advisory
https://bugs.openldap.org/show_bug.cgi?id=9266
Permissions Required
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1740070
Issue Tracking
Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:3674
Third Party Advisory
https://bugs.openldap.org/show_bug.cgi?id=9266
Permissions Required
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1740070
Issue Tracking
Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*

Версия до 2.4.46-10.el8 (исключая)

Конфигурация 2

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:*

Версия до 6.5.1 (исключая)

Конфигурация 5

cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*

Версия до 21.1.2 (исключая)

EPSS

Процентиль: 44%

0.00216

Низкий

4.2 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

CVE-2020-15719

CVSS3: 4.2

ubuntu

больше 5 лет назад

CVE-2020-15719

CVSS3: 4.2

redhat

больше 6 лет назад

CVE-2020-15719

CVSS3: 4.2

debian

больше 5 лет назад

libldap in certain third-party OpenLDAP packages has a certificate-val ...

openSUSE-SU-2020:1459-1

suse-cvrf

больше 5 лет назад

Security update for openldap2

openSUSE-SU-2020:1416-1

suse-cvrf

больше 5 лет назад

Security update for openldap2

EPSS

Процентиль: 44%

0.00216

Низкий

4.2 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-295