OpenConnect up to 8.08 X509_check_ Return Value input validation

Summaryinfo

A vulnerability was found in OpenConnect up to 8.08. It has been classified as critical. Impacted is the function X509_check_. The manipulation as part of Return Value leads to input validation. This vulnerability is listed as CVE-2020-12105. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in OpenConnect up to 8.08. It has been rated as problematic. This issue affects the function X509_check_. The manipulation as part of a Return Value leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality. The summary by CVE is:

OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.

The weakness was presented 04/23/2020. The identification of this vulnerability is CVE-2020-12105 since 04/23/2020. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• OpenConnect

Version

• 8.08

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion