CVE-2020-7042: Medium severity Openfortivpn Project Openfortivpn vulnerability
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-7042?
CVE-2020-7042 is a vulnerability in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later that mishandles certificate validation, allowing a valid certificate to never be accepted.
What is the severity of CVE-2020-7042?
The severity of CVE-2020-7042 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2020-7042?
Versions up to and excluding openfortivpn 1.12.0 and OpenSSL 1.0.2 are affected by CVE-2020-7042.
How can I fix CVE-2020-7042?
To fix CVE-2020-7042, update to a version of openfortivpn above 1.12.0 or use a version of OpenSSL later than 1.0.2.
Where can I find more information about CVE-2020-7042?
You can find more information about CVE-2020-7042 at the following references: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html, http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html, and https://github.com/adrienverge/openfortivpn/commit/9eee997d599a89492281fc7ffdd79d88cd61afc3.