CVE-2020-15719
14.07.2020, 14:15
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openldap | openldap | 𝑥 < 2.4.46-10.el8 |
| redhat | enterprise_linux | 8.0 |
| opensuse | leap | 15.1 |
| opensuse | leap | 15.2 |
| mcafee | policy_auditor | 𝑥 < 6.5.1 |
| oracle | blockchain_platform | 𝑥 < 21.1.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libldap-2_4-2 |
| ||||||||||||||||||||||||||||||||||||||||||
| libldap-2_4-2-32bit |
| ||||||||||||||||||||||||||||||||||||||||||
| libldap-data |
| ||||||||||||||||||||||||||||||||||||||||||
| openldap2 |
| ||||||||||||||||||||||||||||||||||||||||||
| openldap2-back-meta |
| ||||||||||||||||||||||||||||||||||||||||||
| openldap2-back-perl |
| ||||||||||||||||||||||||||||||||||||||||||
| openldap2-client |
| ||||||||||||||||||||||||||||||||||||||||||
| openldap2-devel |
| ||||||||||||||||||||||||||||||||||||||||||
| openldap2-devel-static |
| ||||||||||||||||||||||||||||||||||||||||||
| openldap2-ppolicy-check-password |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
References