Lucene search

PRIOn knowledge basePRION:CVE-2020-15719

HistoryJul 14, 2020 - 2:15 p.m.

Design/Logic Flaw

2020-07-1414:15:00

PRIOn knowledge base

www.prio-n.com

4.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.4%

JSON

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

CPENameOperatorVersion
policy_auditorlt6.5.1
openldapeq< 2.4.46-10.el8
leapeq15.1
leapeq15.2
blockchain_platformlt21.1.2
enterprise_linuxeq8.0

Name	Operator	Version
policy_auditor	lt	6.5.1
openldap	eq	< 2.4.46-10.el8
leap	eq	15.1
leap	eq	15.2
blockchain_platform	lt	21.1.2
enterprise_linux	eq	8.0

References

lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html

lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html

access.redhat.com/errata/RHBA-2019:3674

bugs.openldap.org/show_bug.cgi?id=9266

bugzilla.redhat.com/show_bug.cgi?id=1740070

kc.mcafee.com/corporate/index?page=content&id=SB10365

www.oracle.com/security-alerts/cpuapr2022.html