CVE-2019-3685CWE-295

Missing TLS certificate validation for HTTPS connections in osc

High · published November 5, 2019

CVSS v3.1
7.4
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00714 · 53.1th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2019-11-05T09:30Z
EPSS history
Timeline
  • 05 NOV 09:30Z
    Missing TLS certificate validation for HTTPS connections in osc
    cvelistv5