PT-2020-13176 · Zulip · Zulip Desktop

Published 2020-05-09 · Updated 2020-05-13 · CVE-2020-12637

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zulip Desktop versions prior to 5.2.0

Description The issue is related to Missing SSL Certificate Validation. This occurred because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.

Recommendations For versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the ignoreCerts option until a patch is available. Restrict access to sensitive resources that rely on SSL certificate validation to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-12637

Affected Products

Zulip Desktop

References · 4

• https://osv.dev/vulnerability/CVE-2020-12637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12637 · Security Note
• https://blog.zulip.org/2020/05/06/zulip-desktop-5-2-0-security-release · Vendor Advisory
• https://t.me/cvenotify/3690 · Telegram Post