CVE-2020-7041: Medium severity Openfortivpn Project Openfortivpn vulnerability
Published Feb 27, 2020
·Updated
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509checkhost negative error code is interpreted as a successful return value.
Affected Software
9 affected components
Openfortivpn Project Openfortivpn<1.12.0
OpenSSL OpenSSL<=1.0.2
Fedoraproject Fedora=30
Fedoraproject Fedora=31
Fedoraproject Fedora=32
openSUSE Backports SLE=15.0-sp1
openSUSE Leap=15.1
All of the following
Openfortivpn Project Openfortivpn<1.12.0
OpenSSL OpenSSL<=1.0.2
Remediation
Event History
Feb 27, 2020
CVE Published
via MITRE·05:29 PM
Data Sourced
via MITRE·05:29 PM
Description
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-7041?
The severity of CVE-2020-7041 is medium with a severity value of 5.3.
2
What is the affected software for CVE-2020-7041?
The affected software for CVE-2020-7041 is openfortivpn version 1.11.0 when used with OpenSSL 1.0.2 or later.
3
How does CVE-2020-7041 affect OpenSSL?
CVE-2020-7041 affects OpenSSL by mishandling certificate validation when used with openfortivpn 1.11.0.
4
Is Fedora affected by CVE-2020-7041?
Yes, Fedora versions 30, 31, and 32 are affected by CVE-2020-7041.
5
How can I fix CVE-2020-7041?
To fix CVE-2020-7041, update openfortivpn to version 1.12.0 or higher.