CVE-2020-15719

CWE-295 — Improper Certificate ValidationCWE-2977 documents7 sources
Severity
4.2MEDIUM
EPSS
0.2%
top 55.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Mcafee Policy AuditorOpenldap OpenldapOracle Blockchain Platform+2 more
Timeline
PublishedJul 14
Latest updateMay 24

Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 1.6 | Impact: 2.5

Affected Packages4 packages

▶NVDopenldap/openldap< 2.4.46-10.el8
▶NVDopensuse/leap15.1, 15.2+1

Also affects: Enterprise Linux 8.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-pg7h-v386-fw8h: libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support↗2022-05-24
▶
OSV
CVE-2020-15719: libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support↗2020-07-14
▶
CVEList
CVE-2020-15719: libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support↗2020-07-14
▶

📋Vendor Advisories

2
Debian
CVE-2020-15719: openldap - libldap in certain third-party OpenLDAP packages has a certificate-validation fl...↗2020
▶
Red Hat
openldap: Certificate validation incorrectly matches name against CN-ID↗2019-08-19
▶

💬Community

1
Bugzilla
CVE-2020-15719 openldap: Certificate validation incorrectly matches name against CN-ID↗2020-07-02
▶