CVE-2020-15719
Fixed in a distro release EPSS 2%
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
Products: openldap, redhat enterprise_linux, opensuse leap, mcafee policy_auditor, oracle blockchain_platform
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openldap | no fix |
| Debian 13 | openldap | no fix |
| Debian 14 | openldap | no fix |
| Red Hat Enterprise Linux 8 | openldap | 0:2.4.46-10.el8 |
| Red Hat Enterprise Linux 8 | openldap-clients | 0:2.4.46-10.el8 |
| Red Hat Enterprise Linux 8 | openldap-clients-debuginfo | 0:2.4.46-10.el8 |
| Red Hat Enterprise Linux 8 | openldap-debuginfo | 0:2.4.46-10.el8 |
| Red Hat Enterprise Linux 8 | openldap-debugsource | 0:2.4.46-10.el8 |
| Red Hat Enterprise Linux 8 | openldap-devel | 0:2.4.46-10.el8 |
| Red Hat Enterprise Linux 8 | openldap-servers-debuginfo | 0:2.4.46-10.el8 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | openldap2 | 2.4.46-9.34.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | openldap2 | 2.4.46-9.34.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | openldap2 | 2.4.46-9.34.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | openldap2 | 2.4.46-9.34.1 |
| SUSE Linux Enterprise Module for Legacy 15 SP1 | openldap2 | 2.4.46-9.34.1 |
| SUSE Linux Enterprise Module for Legacy 15 SP2 | openldap2 | 2.4.46-9.34.1 |
| openSUSE Leap 15.1 | openldap2 | 2.4.46-lp151.10.15.1 |
| openSUSE Leap 15.2 | openldap2 | 2.4.46-lp152.14.6.1 |