CVE-2020-15719
Medium
Description
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
SeverityMedium
CVSS4.2
Exploit probability—
Product
Openldap
PublishedJul 14, 2020
First seenJul 14, 2020
How to fix
Update
- openldap openldap2.4.46-10.el8 or later
- mcafee policy_auditor6.5.1 or later
- oracle blockchain_platform21.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openldap openldap | v < 2.4.46-10.el8 | 2.4.46-10.el8 |
| redhat enterprise_linux | 8.0 | — |
| opensuse leap | 15.1, 15.2 | — |
| mcafee policy_auditor | v < 6.5.1 | 6.5.1 |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.