CVE-2020-17494 : Untangle Firewall NG before 16.0 uses MD5 for passwords.

Untangle Firewall NG before 16.0 uses MD5 for passwords.

Published 2020-11-12 21:15:11

Updated 2021-07-21 11:39:24

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-17494

Untangle » Untangle Firewall Ng
Versions before (<) 16.0
cpe:2.3:a:untangle:untangle_firewall_ng:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Assigned by: nvd@nist.gov (Primary)

https://github.com/untangle/ngfw_src/blob/1d232efe2c17a8838b59bbbeaf166dafa94676af/uvm/hier/usr/share/untangle/web/auth/index.py#L196-L200

ngfw_src/index.py at 1d232efe2c17a8838b59bbbeaf166dafa94676af · untangle/ngfw_src · GitHub
Patch;Third Party Advisory
https://pastebin.com/s7UYG3vX

CVE-2020-17494 - Pastebin.com
Third Party Advisory
https://github.com/untangle/ngfw_src/search?q=author%3Abmastbergen+committer-date%3A2020-08-10&type=commits

Search · author:bmastbergen committer-date:2020-08-10 · GitHub
Patch;Third Party Advisory
https://wiki.untangle.com/index.php/16.0.0_-_16.0.1_Changelog

16.0.0 - 16.0.1 Changelog - UntangleWiki
Release Notes;Third Party Advisory

Jump to