PT-2020-6927 · Unknown+4 · Openconnect+4

Jordy Zomer · Published 2020-04-23 · Updated 2024-12-25 · CVE-2020-12105

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenConnect versions prior to 8.08

Description The issue is related to the mishandling of negative return values from X509 check function calls, which could assist attackers in performing man-in-the-middle attacks. This vulnerability is associated with shortcomings in handling exceptional states in the OpenConnect VPN client's X509 check function. Exploitation of this issue may allow a remote attacker to access confidential data.

Recommendations For OpenConnect versions prior to 8.08, update to version 8.08 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

ALT-PU-2020-1908

ALT-PU-2024-17486

ALT-PU-2024-17686

BDU:2023-07616

CVE-2020-12105

MGASA-2020-0251

OPENSUSE-SU-2020:0694-1

OPENSUSE-SU-2020_0694-1

OPENSUSE-SU-2024:11114-1

SUSE-SU-2020:1264-1

SUSE-SU-2020:1337-1

SUSE-SU-2020_1337-1

SUSE-SU-2024:0317-1

Affected Products

Alt Linux

Astra Linux

Debian

Openconnect

Suse

References · 32

• https://security.gentoo.org/glsa/202006-15 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0251 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1264-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1337-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12105 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0317-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0694-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12105 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12105 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0251.html · Security Note
• https://bdu.fstec.ru/vul/2023-07616 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-12105 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11114-1 · Vendor Advisory