1. Home
  2. CVE Database
  3. CVE-2020-1887
CRITICAL · 9.1

CVE-2020-1887

Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.

Vulnerability Description

Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
LinuxfoundationOsquery< 4.2.0

Related Weaknesses (CWE)

CWE-295CWE-297

References

FAQ

What is CVE-2020-1887?

CVE-2020-1887 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.

How severe is CVE-2020-1887?

CVE-2020-1887 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-1887?

Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Osquery.