Vulnerability CVE-2020-12105

Vulnerability Name:

CVE-2020-12105 (CCN-180456)

Assigned:

2020-04-23

Published:

2020-04-23

Updated:

2022-05-03

Summary:

OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.

CVSS v3 Severity:

5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-755

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2020-12105

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2020:0694

Source: XF
Type: UNKNOWN
openconnect-cve202012105-mitm(180456)

Source: CCN
Type: OpenConnect GIT Repository
OpenConnect

Source: CCN
Type: GitLab Web site
incorrect use of X509_check_* functions, leading to MITM attacks

Source: MISC
Type: Third Party Advisory
https://gitlab.com/openconnect/openconnect/-/merge_requests/96

Source: GENTOO
Type: Third Party Advisory
GLSA-202006-15

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-12105

Vulnerable Configuration:

Configuration 1:

cpe:/a:infradead:openconnect:*:*:*:*:*:*:*:* (Version <= 8.08)

Configuration 2:

cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:infradead:openconnect:8.08:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:51560	P	Security update for cni (Important) (in QA)	2022-11-18
oval:org.opensuse.security:def:202012105	V	CVE-2020-12105	2022-09-02
oval:org.opensuse.security:def:684	P	Security update for java-11-openjdk (Important)	2022-08-09
oval:org.opensuse.security:def:3666	P	Security update for wavpack (Low)	2022-08-05
oval:org.opensuse.security:def:3654	P	Security update for pcre2 (Important)	2022-07-27
oval:org.opensuse.security:def:3006	P	ant-1.9.4-3.3.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3014	P	apache2-mod_perl-2.0.8-11.43 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3016	P	atftp-0.7.0-160.8.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3000	P	MozillaFirefox-68.1.0-109.92.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3591	P	libexiv2-12-0.23-12.5.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:1810	P	Security update for the Linux Kernel (Important)	2022-06-24
oval:org.opensuse.security:def:2961	P	kernel-firmware-all-20220119-150400.2.3 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2976	P	libXdmcp-devel-1.1.2-1.23 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95221	P	openconnect-7.08-6.9.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2925	P	g3utils-1.1.37-3.11.2 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2929	P	gdk-pixbuf-loader-rsvg-2.52.6-150400.1.7 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2947	P	gstreamer-plugins-good-1.20.1-150400.1.6 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2967	P	lftp-4.9.2-150400.1.8 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2935	P	glibc-2.31-150300.20.7 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:4709	P	Security update for the Linux Kernel (Live Patch 24 for SLE 12 SP5) (Important)	2022-03-29
oval:org.opensuse.security:def:112734	P	libopenconnect5-8.10-2.6 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:26221	P	Security update for python-numpy (Moderate) (in QA)	2022-01-17
oval:org.opensuse.security:def:4701	P	Security update for the Linux Kernel (Important)	2022-01-13
oval:org.opensuse.security:def:52037	P	Security update for net-snmp (Important)	2022-01-05
oval:org.opensuse.security:def:26223	P	Security update for net-snmp (Important)	2022-01-05
oval:org.opensuse.security:def:26186	P	Security update for libqt4 (Important)	2021-12-22
oval:org.opensuse.security:def:64639	P	Security update for xorg-x11-server (Important)	2021-12-14
oval:org.opensuse.security:def:74751	P	Security update for ImageMagick (Moderate)	2021-12-10
oval:org.opensuse.security:def:70326	P	Security update for the Linux Kernel (Important)	2021-12-07
oval:org.opensuse.security:def:64809	P	Security update for aaa_base (Moderate)	2021-12-03
oval:org.opensuse.security:def:4729	P	Security update for the Linux Kernel (Important)	2021-11-17
oval:org.opensuse.security:def:66970	P	Security update for java-1_8_0-openj9 (Important)	2021-11-04
oval:org.opensuse.security:def:106206	P	libopenconnect5-8.10-2.6 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:69529	P	Security update for openssl-1_1 (Important)	2021-08-24
oval:org.opensuse.security:def:47506	P	stunnel-5.00-3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47697	P	libcairo-gobject2-1.15.2-25.3.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47024	P	libgraphite2-3-1.3.1-6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47385	P	libopenjp2-7-2.1.0-3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47595	P	dosfstools-3.0.26-6.5 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47568	P	bluez-5.13-5.4.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47734	P	libldap-2_4-2-2.4.41-18.40.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47061	P	libpng15-15-1.5.22-4.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47422	P	libudisks2-0-2.1.3-1.13 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47626	P	gnome-shell-search-provider-nautilus-3.20.3-23.6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47632	P	gstreamer-1.8.3-9.5 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:46933	P	elfutils-0.158-6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47171	P	update-alternatives-1.18.4-14.216 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48335	P	vorbis-tools-1.4.0-26.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47469	P	perl-XML-LibXML-2.0019-5.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47663	P	libHX28-3.18-1.18 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:46970	P	ipsec-tools-0.8.0-15.16 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47208	P	at-3.1.14-7.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47531	P	xf86-video-intel-2.99.917.770_gcb6ba2da-1.23 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:63092	P	java-1_8_0-openjdk-1.8.0.282-3.48.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63504	P	openconnect-7.08-6.9.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2415	P	openconnect-7.08-6.9.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63385	P	xen-4.14.1_16-1.6 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:101057	P	python3-Pygments-2.6.1-2.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:49443	P	Security update for nodejs10 (Important)	2021-07-14
oval:org.opensuse.security:def:49442	P	Security update for nodejs14 (Important)	2021-07-14
oval:org.opensuse.security:def:73661	P	Security update for arpwatch (Important)	2021-06-28
oval:org.opensuse.security:def:64537	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:68810	P	Security update for cryptctl (Important)	2021-06-23
oval:org.opensuse.security:def:46489	P	libjbig2-2.0-12.13 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48389	P	cpp48-4.8.5-30.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46512	P	libqt4-32bit-4.8.6-2.11 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46801	P	openssh-6.6p1-29.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46526	P	libvorbis-doc-1.3.3-8.23 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48426	P	giflib-progs-5.0.5-12.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46838	P	rsyslog-8.4.0-8.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46476	P	libecpg6-9.3.5-2.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46609	P	alsa-1.0.27.2-11.10 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46513	P	libraptor2-0-2.0.10-3.63 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46475	P	libdmx1-1.1.3-3.51 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46646	P	dovecot22-2.2.13-2.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48372	P	at-3.1.14-7.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:64697	P	Security update for python-httplib2 (Moderate)	2021-05-31
oval:org.opensuse.security:def:70221	P	Security update for djvulibre (Important)	2021-05-19
oval:org.opensuse.security:def:65566	P	Security update for dtc (Low)	2021-05-13
oval:org.opensuse.security:def:5679	P	Security update for python-Pygments (Important)	2021-05-04
oval:org.opensuse.security:def:69634	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:49461	P	Security update for nodejs12 (Important)	2021-02-26
oval:org.opensuse.security:def:51152	P	Security update for python3 (Important)	2021-02-08
oval:org.opensuse.security:def:66878	P	Security update for openvswitch (Important)	2021-02-01
oval:org.opensuse.security:def:5648	P	Security update for the Linux Kernel (Moderate)	2021-01-14
oval:org.opensuse.security:def:51666	P	Security update for java-1_8_0-ibm (Moderate)	2021-01-05
oval:org.opensuse.security:def:72266	P	libcairo2-32bit-1.15.10-4.5.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62889	P	bsdtar-3.3.2-3.8.4 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63588	P	libotr-devel-4.1.1-2.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107723	P	openconnect-7.08-6.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62882	P	FastCGI-2.4.0-2.23 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72150	P	libXvnc-devel-1.8.0-11.23 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:117238	P	openconnect-7.08-6.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:94344	P	openconnect-7.08-6.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62914	P	pam-devel-32bit-1.3.0-6.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63641	P	openconnect-7.08-6.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2552	P	openconnect-7.08-6.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62886	P	apache-pdfbox-1.8.12-5.6.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:4997	P	Security update for php7 (Moderate)	2020-12-02
oval:org.opensuse.security:def:4819	P	Security update for apache2 (Important)	2020-12-02
oval:org.opensuse.security:def:4853	P	Security update for rsyslog (Moderate)	2020-12-02
oval:org.opensuse.security:def:4951	P	Security update for krb5 (Moderate)	2020-12-02
oval:org.opensuse.security:def:4983	P	Security update for tomcat (Important)	2020-12-02
oval:org.opensuse.security:def:5010	P	Security update for tomcat (Important)	2020-12-02
oval:org.opensuse.security:def:4774	P	Security update for libvirt (Moderate)	2020-12-02
oval:org.opensuse.security:def:4834	P	Security update for libvirt (Important)	2020-12-02
oval:org.opensuse.security:def:4926	P	Security update for squid (Important)	2020-12-02
oval:org.opensuse.security:def:4990	P	Security update for nodejs8 (Important)	2020-12-02
oval:org.opensuse.security:def:25117	P	Security update for java-1_8_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:52115	P	Security update for libexif (Moderate)	2020-12-01
oval:org.opensuse.security:def:50688	P	Security update for nfs-utils (Moderate)	2020-12-01
oval:org.opensuse.security:def:25350	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:52386	P	Security update for qemu (Important)	2020-12-01
oval:org.opensuse.security:def:65476	P	Security update for ceph, ceph-iscsi, ses-manual_en (Moderate)	2020-12-01
oval:org.opensuse.security:def:49588	P	open-vm-tools-desktop on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:53853	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:24828	P	Security update for libpng16 (Moderate)	2020-12-01
oval:org.opensuse.security:def:49939	P	apache2-mod_security2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25585	P	Security update for webkit2gtk3 (Important)	2020-12-01
oval:org.opensuse.security:def:26258	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:25017	P	Security update for ceph (Moderate)	2020-12-01
oval:org.opensuse.security:def:50194	P	libgadu-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50197	P	libopencv3_3 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:63964	P	Security update for curl (Important)	2020-12-01
oval:org.opensuse.security:def:68913	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:25154	P	Security update for webkit2gtk3 (Important)	2020-12-01
oval:org.opensuse.security:def:50522	P	Security update for mozilla-nspr, mozilla-nss (Moderate)	2020-12-01
oval:org.opensuse.security:def:50992	P	Security update for bluez (Important)	2020-12-01
oval:org.opensuse.security:def:64429	P	pam_yubico on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52422	P	Security update for xorg-x11-server (Important)	2020-12-01
oval:org.opensuse.security:def:72987	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:25387	P	Security update for shim (Moderate)	2020-12-01
oval:org.opensuse.security:def:66206	P	Security update for tomcat (Important)	2020-12-01
oval:org.opensuse.security:def:25490	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:24854	P	Security update for vino (Moderate)	2020-12-01
oval:org.opensuse.security:def:25061	P	Security update for libseccomp (Moderate)	2020-12-01
oval:org.opensuse.security:def:51832	P	Security update for tar (Moderate)	2020-12-01
oval:org.opensuse.security:def:25200	P	Security update for java-1_8_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:50592	P	Security update for libsolv, libzypp, zypper (Moderate)	2020-12-01
oval:org.opensuse.security:def:52223	P	Security update for bcm43xx-firmware (Moderate)	2020-12-01
oval:org.opensuse.security:def:50761	P	Security update for gnutls (Important)	2020-12-01
oval:org.opensuse.security:def:50251	P	openconnect on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25403	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:50991	P	Security update for freetype2 (Important)	2020-12-01
oval:org.opensuse.security:def:49793	P	ocaml on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25504	P	Security update for libvirt (Important)	2020-12-01
oval:org.opensuse.security:def:24781	P	Security update for sane-backends (Important)	2020-12-01
oval:org.opensuse.security:def:25527	P	Security update for java-11-openjdk (Moderate)	2020-12-01
oval:org.opensuse.security:def:24891	P	Security update for qemu (Moderate)	2020-12-01
oval:org.opensuse.security:def:50037	P	stunnel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:72869	P	Security update for mariadb (Moderate)	2020-12-01
oval:org.opensuse.security:def:66298	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:63735	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:25098	P	Security update for python-numpy (Important)	2020-12-01
oval:org.opensuse.security:def:50432	P	Security update for java-11-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:74884	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:64293	P	libHX-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50657	P	Security update for ghostscript (Moderate)	2020-12-01
oval:org.opensuse.security:def:53779	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:25237	P	Security update for libvpx (Moderate)	2020-12-01
oval:org.opensuse.security:def:52314	P	Recommended update for ruby2.5 (Important)	2020-12-01
oval:org.opensuse.security:def:51014	P	Security update for krb5 (Moderate)	2020-12-01
oval:org.opensuse.security:def:64430	P	patch on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52503	P	Security update for java-11-openjdk (Moderate)	2020-12-01
oval:org.opensuse.security:def:52099	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:24791	P	Security update for java-1_7_0-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:25440	P	Security update for python-xdg (Moderate)	2020-12-01
oval:org.opensuse.security:def:25548	P	Security update for ceph (Important)	2020-12-01
oval:org.opensuse.security:def:51389	P	Security update for apache-pdfbox (Moderate)	2020-12-01
oval:org.opensuse.security:def:25541	P	Security update for java-1_8_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:24818	P	Security update for ppp (Important)	2020-12-01
oval:org.opensuse.security:def:24980	P	Security update for ucode-intel (Important)	2020-12-01
oval:org.opensuse.security:def:73543	P	kernel-azure-base on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:99865	P	(Important)	2020-05-29
oval:org.opensuse.security:def:110546	P	Security update for openconnect (Moderate)	2020-05-22
oval:org.opensuse.security:def:75293	P	Security update for openconnect (Moderate)	2020-05-19
oval:org.opensuse.security:def:93374	P	Security update for openconnect (Moderate)	2020-05-19
oval:org.opensuse.security:def:97897	P	Security update for openconnect (Moderate)	2020-05-19
oval:org.opensuse.security:def:90932	P	Security update for openconnect (Moderate)	2020-05-19
oval:org.opensuse.security:def:104587	P	Security update for openconnect (Moderate)	2020-05-19
oval:org.opensuse.security:def:127466	P	Security update for openconnect (Moderate)	2020-05-13

BACK