CVE-2020-15719

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support

published July 14, 2020

CVSS
—
EPSS
3%
Percentile
84.7
In the wild
Unconfirmed
What it is

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02515 · 84.7th percentile
Published
2020-07-14T13:47Z
EPSS history
Timeline
  • 14 JUL 13:47Z
    libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support
    cvelistv5