Vulnerability Description
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openldap | Openldap | < 2.4.46-10.el8 |
| Redhat | Enterprise Linux | 8.0 |
| Opensuse | Leap | 15.1 |
| Mcafee | Policy Auditor | < 6.5.1 |
| Oracle | Blockchain Platform | < 21.1.2 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHBA-2019:3674Third Party Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9266Permissions RequiredVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1740070Issue TrackingThird Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHBA-2019:3674Third Party Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9266Permissions RequiredVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1740070Issue TrackingThird Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2020-15719?
CVE-2020-15719 is a vulnerability with a CVSS score of 4.2 (MEDIUM). libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectA...
How severe is CVE-2020-15719?
CVE-2020-15719 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15719?
Check the references section above for vendor advisories and patch information. Affected products include: Openldap Openldap, Redhat Enterprise Linux, Opensuse Leap, Mcafee Policy Auditor, Oracle Blockchain Platform.