CVE-2020-12637: Critical severity zulip desktop vulnerability
Published May 9, 2020
·Updated
Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.
Affected Software
1 affected component
Zulipchat Zulip Desktop>=0.5.10<5.2.0
Event History
May 9, 2020
CVE Published
via MITRE·04:23 PM
Data Sourced
via MITRE·04:23 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-12637?
CVE-2020-12637 is considered a high severity vulnerability due to missing SSL certificate validation.
2
How do I fix CVE-2020-12637?
To fix CVE-2020-12637, upgrade Zulip Desktop to version 5.2.0 or later.
3
What causes CVE-2020-12637?
CVE-2020-12637 is caused by the accidental disabling of SSL certificate validation when configuring the ignoreCerts option.
4
Which versions of Zulip Desktop are affected by CVE-2020-12637?
Zulip Desktop versions from 0.5.10 up to but not including 5.2.0 are affected by CVE-2020-12637.
5
What is the impact of exploiting CVE-2020-12637?
Exploiting CVE-2020-12637 could allow attackers to perform man-in-the-middle attacks due to the lack of SSL certificate validation.