PT-2020-16363 · Opencast Community · Opencast

Intrigus-Lgtm · Published 2020-12-08 · Updated 2020-12-10 · CVE-2020-26234

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.9 Opencast versions prior to 8.9

Description The issue concerns Opencast's HTTP client, which disables HTTPS hostname verification for a large portion of its HTTP requests. Hostname verification is crucial when using HTTPS to ensure the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.9. After fixing the problem, Opencast will no longer accept self-signed certificates without properly importing them into the Java key store.

Recommendations For Opencast versions prior to 7.9, update to Opencast 7.9 or later to fix the issue. For Opencast versions prior to 8.9, update to Opencast 8.9 or later to fix the issue. As a general mitigation measure, consider importing self-signed certificates into the Java key store or obtaining a valid certificate to ensure secure communication.

Fix

Origin Validation Error

Weakness Enumeration

CWE-297

CWE-346

Related Identifiers

CVE-2020-26234

GHSA-44CW-P2HM-GPF6

Affected Products

Opencast

References · 7

• https://github.com/opencast/opencast/commit/4225bf90af74557deaf8fb6b80b0705c9621acfc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26234 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26234 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-44cw-p2hm-gpf6 · Vendor Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-44cw-p2hm-gpf6 · Note
• https://t.me/cvenotify/6789 · Telegram Post
• https://t.me/cibsecurity/17460 · Telegram Post