OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.
Weakness
The product does not handle or incorrectly handles an exceptional condition.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openconnect | Infradead | * | 8.08 (including) |
| Openconnect | Ubuntu | eoan | * |
| Openconnect | Ubuntu | groovy | * |
| Openconnect | Ubuntu | hirsute | * |
| Openconnect | Ubuntu | impish | * |
| Openconnect | Ubuntu | trusty | * |
| Openconnect | Ubuntu | upstream | * |
| Openconnect | Ubuntu | xenial | * |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html
- https://gitlab.com/openconnect/openconnect/-/merge_requests/96
- https://security.gentoo.org/glsa/202006-15
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html
- https://gitlab.com/openconnect/openconnect/-/merge_requests/96
- https://security.gentoo.org/glsa/202006-15