CVE-2020-12105

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.htmlMailing List, Third Party Advisory
https://gitlab.com/openconnect/openconnect/-/merge_requests/96Third Party Advisory
https://security.gentoo.org/glsa/202006-15Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.htmlMailing List, Third Party Advisory
https://gitlab.com/openconnect/openconnect/-/merge_requests/96Third Party Advisory
https://security.gentoo.org/glsa/202006-15Third Party Advisory

Timeline

Published: Apr 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-121069.8The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administr CVE-2020-121079.8The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this module CVE-2020-121086.5/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.CVE-2020-121098.8Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, CVE-2020-12117.8An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connec CVE-2020-121109.8Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 2 CVE-2020-121118.8Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304.CVE-2020-121127.5BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.CVE-2020-121136.1BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.CVE-2020-121144.7A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x CVE-2020-121167.5Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary CVE-2020-121175.3Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted pa