CVEvulnerability
CVE-2020-7042
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-02-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-295, CWE-908
Description
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
Affected configurations
• openfortivpn project openfortivpn (< 1.12.0)
• fedoraproject fedora 30
• fedoraproject fedora 31
• fedoraproject fedora 32
• opensuse backports sle 15.0
• opensuse leap 15.1
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html Mailing List, Third Party Advisory
- https://github.com/adrienverge/openfortivpn/commit/9eee997d599a89492281fc7ffdd79d88cd61afc3 Patch, Third Party Advisory
- https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4 Patch, Third Party Advisory
- https://github.com/adrienverge/openfortivpn/issues/536 Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKNKSGBVYGRRVRLFEFBEKUEJYJR5LWOF/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FF6HYIBREQGATRM5COF57MRQWKOKCWZ3/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SRVVNXCNTNMPCIAZIVR4FAGYCSU53FNA/ lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html Mailing List, Third Party Advisory
- https://github.com/adrienverge/openfortivpn/commit/9eee997d599a89492281fc7ffdd79d88cd61afc3 Patch, Third Party Advisory
- https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4 Patch, Third Party Advisory
- https://github.com/adrienverge/openfortivpn/issues/536 Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKNKSGBVYGRRVRLFEFBEKUEJYJR5LWOF/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FF6HYIBREQGATRM5COF57MRQWKOKCWZ3/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SRVVNXCNTNMPCIAZIVR4FAGYCSU53FNA/ lists.fedoraproject.org