CVE-2020-11580: Critical severity ivanti pulse connect secure vulnerability
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-11580?
CVE-2020-11580 is a vulnerability in Pulse Secure Pulse Connect Secure (PCS) and Pulse Policy Secure that allows an attacker to impersonate any SSL certificate.
How severe is CVE-2020-11580?
CVE-2020-11580 has a severity rating of 9.1 (critical).
Which software versions are affected by CVE-2020-11580?
Pulse Secure Pulse Connect Secure (PCS) and Pulse Policy Secure versions up to and including 2020-04-06 are affected.
How can I fix CVE-2020-11580?
To fix CVE-2020-11580, update to a version of Pulse Secure Pulse Connect Secure (PCS) or Pulse Policy Secure that is later than 2020-04-06.
Where can I find more information about CVE-2020-11580?
You can find more information about CVE-2020-11580 on the GitLab page (https://git.lsd.cat/g/pulse-host-checker-rce) and the Pulse Secure Knowledge Base (https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426).