Unrated severityNVD Advisory· Published Jul 14, 2020· Updated Aug 4, 2024
CVE-2020-15719
CVE-2020-15719
Description
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
Affected products
10- OpenLDAP/OpenLDAPdescription
- osv-coords9 versionspkg:bitnami/openldappkg:rpm/opensuse/openldap2&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/openldap2&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP1pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP1pkg:rpm/suse/openldap2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP2
< 2.4.46-10.el8+ 8 more
- (no CPE)range: < 2.4.46-10.el8
- (no CPE)range: < 2.4.46-lp151.10.15.1
- (no CPE)range: < 2.4.46-lp152.14.6.1
- (no CPE)range: < 2.4.46-9.34.1
- (no CPE)range: < 2.4.46-9.34.1
- (no CPE)range: < 2.4.46-9.34.1
- (no CPE)range: < 2.4.46-9.34.1
- (no CPE)range: < 2.4.46-9.34.1
- (no CPE)range: < 2.4.46-9.34.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.htmlmitrevendor-advisoryx_refsource_SUSE
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.htmlmitrevendor-advisoryx_refsource_SUSE
- access.redhat.com/errata/RHBA-2019:3674mitrex_refsource_MISC
- bugs.openldap.org/show_bug.cgimitrex_refsource_MISC
- bugzilla.redhat.com/show_bug.cgimitrex_refsource_MISC
- kc.mcafee.com/corporate/indexmitrex_refsource_CONFIRM
- www.oracle.com/security-alerts/cpuapr2022.htmlmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.