CVE-2024-7346: Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation
Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.
Affected Software
Remediation
Information
Information
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7346?
CVE-2024-7346 has been assessed to have a moderate severity level due to the potential bypass of host name validation.
How do I fix CVE-2024-7346?
To fix CVE-2024-7346, ensure that default TLS certificates are no longer used and implement custom certificates that enforce host name validation.
Which versions of Progress OpenEdge are affected by CVE-2024-7346?
CVE-2024-7346 affects Progress OpenEdge versions up to and including 11.7.19, as well as versions between 12.0 and 12.2.14.
What is the impact of CVE-2024-7346 on network security?
The impact of CVE-2024-7346 can lead to compromised security as it allows attackers to potentially intercept and manipulate communications due to bypassed host name validation.
Is there a workaround for CVE-2024-7346?
A possible workaround for CVE-2024-7346 is to replace the default certificates with verified custom certificates that enforce proper host name validation.