Vulnerability · Published Jul 14, 2020 · Assigned by mitre
CVE-2020-15719
Medium 4.2
In plain English
A medium-severity security flaw in the openldap package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS NVD)4.2Medium
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | openldap | no fix listed | DEBIAN-CVE-2020-15719 |
| Debian:13 | openldap | no fix listed | DEBIAN-CVE-2020-15719 |
| Debian:14 | openldap | no fix listed | DEBIAN-CVE-2020-15719 |
Affected products (as reported)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1740070 x_refsource_MISC
- https://bugs.openldap.org/show_bug.cgi?id=9266 x_refsource_MISC
- https://access.redhat.com/errata/RHBA-2019:3674 x_refsource_MISC
- openSUSE-SU-2020:1416 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1459 vendor-advisory, x_refsource_SUSE
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365 x_refsource_CONFIRM