| Name | CVE-2020-15719 |
| Description | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 965184 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| openldap (PTS) | jessie, jessie (lts) | 2.4.40+dfsg-1+deb8u11 | vulnerable |
| stretch (security), stretch (lts), stretch | 2.4.44+dfsg-5+deb9u9 | vulnerable |
| buster (security), buster, buster (lts) | 2.4.47+dfsg-3+deb10u7 | vulnerable |
| bullseye (security), bullseye | 2.4.57+dfsg-3+deb11u1 | vulnerable |
| bookworm | 2.5.13+dfsg-5 | vulnerable |
| sid, trixie | 2.5.18+dfsg-3 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| openldap | source | (unstable) | (unfixed) | unimportant | | 965184 |
Notes
https://bugs.openldap.org/show_bug.cgi?id=9266
https://bugzilla.redhat.com/show_bug.cgi?id=1740070
RedHat/CentOS applied patch: https://git.centos.org/rpms/openldap/raw/67459960064be9d226d57c5f82aaba0929876813/f/SOURCES/openldap-tlso-dont-check-cn-when-bad-san.patch
OpenLDAP upstream did dispute the issue as beeing valid, as the current libldap
behaviour does conform with RFC4513. RFC6125 does not superseed the rules for
verifying service identity provided in specifications for existing application
protocols published prior to RFC6125, like RFC4513 for LDAP.
[jessie] - openldap <no-dsa> (Minor issue, works as intended)