54 matches found
OPENSUSE-SU-2020:0305-1 Security update for openfortivpn
This update for openfortivpn to version 1.12.0 fixes the following issues: - CVE-2020-7043: Fixed a TLS Certificate CommonName NULL Byte Vulnerability boo1165301. - CVE-2020-7042: Fixed use of uninitialized memory in X509checkhost boo1165300. - CVE-2020-7041: Fixed incorrect use of X509checkhost...
openSUSE: Security Advisory for openfortivpn (openSUSE-SU-2020:0301-1)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Security update for openfortivpn (important)
openSUSE Security Update: Security update for openfortivpn Announcement ID: openSUSE-SU-2020:0305-1 Rating: important References: 1165299 1165300 1165301 Cross-References: CVE-2020-7041 CVE-2020-7042 CVE-2020-7043 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes three...
OPENSUSE-SU-2020:0301-1 Security update for openfortivpn
This update for openfortivpn to version 1.12.0 fixes the following issues: - CVE-2020-7043: Fixed a TLS Certificate CommonName NULL Byte Vulnerability boo1165301. - CVE-2020-7042: Fixed use of uninitialized memory in X509checkhost boo1165300. - CVE-2020-7041: Fixed incorrect use of X509checkhost...
Security update for openfortivpn (important)
openSUSE Security Update: Security update for openfortivpn Announcement ID: openSUSE-SU-2020:0301-1 Rating: important References: 1165299 1165300 1165301 Cross-References: CVE-2020-7041 CVE-2020-7042 CVE-2020-7043 Affected Products: openSUSE Leap 15.1 An update that fixes three vulnerabilities is...
openfortivpn Certificate Validation Mishandling Vulnerability (CNVD-2020-14761)
openfortivpn is a client for PPP+SSL VPN tunneling services. A certificate validation mishandling vulnerability exists in openfortivpn 1.11.0. The vulnerability stems from hostname checking being performed on uninitialized memory. An attacker can exploit this vulnerability to cause a valid...
openfortivpn Certificate Validation Mishandling Vulnerability
openfortivpn is a client program for PPP Point-to-Point Protocol + SSL Transport Layer Security Protocol VPN tunneling service. A security vulnerability exists in openfortivpn version 1.11.0 using OpenSSL versions prior to 1.0.2, which stems from a failure to take into account the '' character wh...
CVE-2020-7042
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted only a malformed certificate may be accepted...
CVE-2020-7043
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack...
CVE-2020-7043
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack...
DEBIAN-CVE-2020-7043
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack...
DEBIAN-CVE-2020-7042
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted only a malformed certificate may be accepted...
CVE-2020-7041
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509checkhost negative error code is interpreted as a successful return value...
CVE-2020-7042
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted only a malformed certificate may be accepted...
CVE-2020-7041
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509checkhost negative error code is interpreted as a successful return value...
DEBIAN-CVE-2020-7041
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509checkhost negative error code is interpreted as a successful return value...
Code injection
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509checkhost negative error code is interpreted as a successful return value...
CVE-2020-7042
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted only a malformed certificate may be accepted...
Design/Logic Flaw
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted only a malformed certificate may be accepted...
CVE-2020-7041
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509checkhost negative error code is interpreted as a successful return value...