PT-2020-14606 · Openldap+3 · Openldap+3

Published 2019-04-21 · Updated 2024-03-06 · CVE-2020-15719

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.46-10.el8

Description The issue is related to a certificate-validation flaw in libldap when asserting RFC6125 support. Specifically, it considers the Common Name (CN) even when there is a non-matching subjectAltName (SAN).

Recommendations For versions prior to 2.4.46-10.el8, update to a version that includes the fix, such as openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2019-1705

BIT-OPENLDAP-2020-15719

CVE-2020-15719

ECHO-131F-3301-69B0

OPENSUSE-SU-2020:1416-1

OPENSUSE-SU-2020:1459-1

OPENSUSE-SU-2020_1416-1

OPENSUSE-SU-2020_1459-1

SUSE-SU-2020:2581-1

SUSE-SU-2020_2581-1

Affected Products

Alt Linux

Debian

Openldap

Suse

References · 21

• https://osv.dev/vulnerability/SUSE-SU-2020:2581-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1459-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15719 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15719 · Security Note
• https://bugs.openldap.org/show_bug.cgi?id=9266 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-openldap-2020-15719 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1416-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15719 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15719 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:3674 · Note
• https://suse.com/security/cve/CVE-2020-15719 · Note
• https://bugzilla.suse.com/1174154 · Note