What’s Vulnerable › Vulnerabilities

CVE-2020-15719

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-14 · updated 2026-06-17
• Weakness: CWE-295

Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

Affected products

• McAfee,LLC McAfee Policy Auditor: before 6.5.1 — fixed in 6.5.1
• openldap: before 2.4.46-10.el8 — fixed in 2.4.46-10.el8
• openSUSE Leap: 15.1, 15.2
• Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
• Red Hat Enterprise Linux: 8.0

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Policy Auditor 6.5.1; openldap 2.4.46-10.el8; Oracle Blockchain Platform 21.1.2. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html
• https://access.redhat.com/errata/RHBA-2019:3674
• https://bugs.openldap.org/show_bug.cgi?id=9266
• https://bugzilla.redhat.com/show_bug.cgi?id=1740070
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://www.oracle.com/security-alerts/cpuapr2022.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html
• https://access.redhat.com/errata/RHBA-2019:3674
• https://bugs.openldap.org/show_bug.cgi?id=9266
• https://bugzilla.redhat.com/show_bug.cgi?id=1740070

Get alerted when CVE-2020-15719 or the next vulnerability affects your stack