Openfortivpn Project vulnerabilities
3 vulnerabilities
Known vulnerabilities in Openfortivpn Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Openfortivpn3 vulnerabilities
CVE-2020-7042debianopenfortivpn+5
EPSS score1.58%
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).CVE-2020-7041debianopenfortivpn+5EPSS score1.75%
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value.CVE-2020-7043debianopenfortivpn+5EPSS score2.76%
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack.