An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openfortivpn | Openfortivpn_project | * | 1.12.0 (excluding) |
| Openfortivpn | Ubuntu | bionic | * |
| Openfortivpn | Ubuntu | eoan | * |
| Openfortivpn | Ubuntu | trusty | * |
| Openfortivpn | Ubuntu | upstream | * |