4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2020-15719

CVE-2020-15719: libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third...

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2020-15719

CVE-2020-15719:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2020-15719 describes an improper certificate validation flaw in libldap, specifically in how it handles Common Names (CN) and Subject Alternative Names (SAN) when RFC6125 support is asserted by third-party packages. The fetched OpenLDAP bug report (9266) and the Red Hat Bugzilla entry (1740070) discuss this issue. The crucial piece of evidence is the patch file (attachment.cgi?id=734 from the OpenLDAP bug tracker), which shows the exact code changes in libraries/libldap/tls_o.c within the function tlso_session_chkhost. The removed sections of this function clearly demonstrate the old, vulnerable logic: a custom implementation for checking SANs, and if that check didn't result in a match, a subsequent fallback to checking the CN. This fallback, when SANs are present but don't match, is the core of the vulnerability. The patch replaces this custom logic with calls to OpenSSL's X509_check_host and X509_check_ip functions, which are presumed to handle this correctly. Therefore, tlso_session_chkhost is identified as the vulnerable function, with the evidence being the removed code that implemented the incorrect fallback.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.