CVE-2020-12105 — Improper Handling of Exceptional Conditions in Openconnect
Severity
5.9MEDIUMNVD
EPSS
0.2%
top 61.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 23
Latest updateMay 24
Description
OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages2 packages
🔴Vulnerability Details
3📋Vendor Advisories
1Debian▶
CVE-2020-12105: openconnect - OpenConnect through 8.08 mishandles negative return values from X509_check_ func...↗2020
💬Community
3Bugzilla▶
CVE-2020-12105 openconnect: incorrect use of negative return values from X509_check_ functions can lead to MITM attacks [fedora-all]↗2020-05-21
Bugzilla▶
CVE-2020-12105 openconnect: incorrect use of negative return values from X509_check_ functions can lead to MITM attacks↗2020-05-21
Bugzilla▶
CVE-2020-12105 openconnect: incorrect use of negative return values from X509_check_ functions can lead to MITM attacks [epel-all]↗2020-05-21