CVE-2020-15719 : libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asser

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

Published 2020-07-14 14:15:18

Updated 2022-05-12 15:01:09

Source MITRE

View at NVD, CVE.org

Threat overview for CVE-2020-15719

Top countries where our scanners detected CVE-2020-15719

Top open port discovered on systems with this issue 53

IPs affected by CVE-2020-15719 16,811

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-15719!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-15719

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-15719

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:N	4.9	4.9	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
4.2	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N	1.6	2.5	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

References for CVE-2020-15719

https://www.oracle.com/security-alerts/cpuapr2022.html

Oracle Critical Patch Update Advisory - April 2022
Patch;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html

[security-announce] openSUSE-SU-2020:1416-1: moderate: Security update f
Mailing List;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1740070

1740070 – TLS setup should not fall back to matching CN if there is a SAN that does not match the server's host name
Issue Tracking;Third Party Advisory
https://bugs.openldap.org/show_bug.cgi?id=9266

Issue Access Denied
Permissions Required;Vendor Advisory
https://access.redhat.com/errata/RHBA-2019:3674

RHBA-2019:3674 - Bug Fix Advisory - Red Hat Customer Portal
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html

[security-announce] openSUSE-SU-2020:1459-1: moderate: Security update f
Mailing List;Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Security Bulletin - Policy Auditor update fixes multiple vulnerabilities in third-party libraries (CVE-2016-0718, CVE-2016-4472, CVE-2016-5300, CVE-2017-17740, CVE-2017-9287, CVE-2019-13057, CVE-2020-
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2020-15719

Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Oracle » Blockchain Platform
Versions before (<) 21.1.2
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
Matching versions
Mcafee » Policy Auditor
Versions before (<) 6.5.1
cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:*
Matching versions
Openldap » Openldap
Versions before (<) 2.4.46-10.el8
cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-15719

Threat overview for CVE-2020-15719

Exploit prediction scoring system (EPSS) score for CVE-2020-15719

CVSS scores for CVE-2020-15719

CWE ids for CVE-2020-15719

References for CVE-2020-15719

Products affected by CVE-2020-15719