60
CVE-2020-7043
—CVSS 3.1
9.1 critical
EPSS
3%p85
Published
()
Modified
Description
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack.
- Vendors
- openfortivpn projectfedoraprojectopensuse
- Products
- openfortivpn, fedora, backports sle, leap
- Weakness
- CWE-295
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N