CVE-2020-15720
First published: Tue Jun 23 2020(Updated: )
A flaw was found in PKI, where the dogtag's pki.client.PKIConnection class disables the python-requests certificate validation. This flaw allows an attacker to intercept a connection between a FreeIPA client and a server, and execute an active Man-in-the-Middle attack. The highest threat from this vulnerability is to confidentiality and integrity.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dogtagpki Dogtagpki | <=10.8.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1855273
- https://github.com/dogtagpki/pki/commit/50c23ec146ee9abf28c9de87a5f7787d495f0b72
- https://github.com/dogtagpki/pki/compare/v10.9.0-a2...v10.9.0-b1
- https://requests.readthedocs.io/en/master/user/advanced/#ssl-cert-verification
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1855854
- https://access.redhat.com/security/cve/cve-2020-15720
- https://access.redhat.com/errata/RHSA-2020:4847
- https://www.cve.org/CVERecord?id=CVE-2020-15720 https://nvd.nist.gov/vuln/detail/CVE-2020-15720
Frequently Asked Questions
What is CVE-2020-15720?
CVE-2020-15720 is a vulnerability found in Dogtag PKI.
What is the severity of CVE-2020-15720?
CVE-2020-15720 has a severity score of 6.8 (medium).
How does CVE-2020-15720 affect Dogtag PKI?
CVE-2020-15720 affects Dogtag PKI versions up to 10.8.3.
How can I fix CVE-2020-15720?
To fix CVE-2020-15720, update Dogtag PKI to version 10.9.0 or later.
Where can I find more information about CVE-2020-15720?
You can find more information about CVE-2020-15720 at the following references: 1. [CVE-2020-15720 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2020-15720) 2. [CVE-2020-15720 on NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-15720) 3. [Bugzilla Bug Report](https://bugzilla.redhat.com/show_bug.cgi?id=1855273) 4. [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2020:4847)
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/severity
- agent/author
- agent/weakness
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-15720
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/trending
- vendor/dogtagpki
- canonical/dogtagpki dogtagpki
- version/dogtagpki dogtagpki/10.8.3
- package-manager/redhat