CVE-2010-3902

2010-10-1405:58:42

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

73.5%

JSON

OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.

OSVersionArchitecturePackageVersionFilename
Debian12allopenconnect< 3.02-1openconnect_3.02-1_all.deb
Debian11allopenconnect< 3.02-1openconnect_3.02-1_all.deb
Debian10allopenconnect< 3.02-1openconnect_3.02-1_all.deb
Debian999allopenconnect< 3.02-1openconnect_3.02-1_all.deb
Debian13allopenconnect< 3.02-1openconnect_3.02-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	openconnect	< 3.02-1	openconnect_3.02-1_all.deb
Debian	11	all	openconnect	< 3.02-1	openconnect_3.02-1_all.deb
Debian	10	all	openconnect	< 3.02-1	openconnect_3.02-1_all.deb
Debian	999	all	openconnect	< 3.02-1	openconnect_3.02-1_all.deb
Debian	13	all	openconnect	< 3.02-1	openconnect_3.02-1_all.deb