What’s Vulnerable › Vulnerabilities

CVE-2020-12105

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-23 · updated 2026-06-17
• Weakness: CWE-755

Description

OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.

Affected products

• Infradead Openconnect: through 8.08
• openSUSE Leap: 15.1

References

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html
• https://gitlab.com/openconnect/openconnect/-/merge_requests/96
• https://security.gentoo.org/glsa/202006-15
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html
• https://gitlab.com/openconnect/openconnect/-/merge_requests/96
• https://security.gentoo.org/glsa/202006-15

Get alerted when CVE-2020-12105 or the next vulnerability affects your stack