CPE Details
openfortivpn Project openfortivpn 1.3.1
1.3.1
2020-03-04
18h03 +00:00
18h03 +00:00
2020-03-04
18h03 +00:00
18h03 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:openfortivpn_project:openfortivpn:1.3.1:*:*:*:*:*:*:*
Informations
Vendor
openfortivpn_projectProduct
openfortivpnVersion
1.3.1Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack. | 9.1 |
Critical |
||
| An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted). | 5.3 |
Medium |
||
| An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value. | 5.3 |
Medium |
