CVSS: 7.4EPSS: 0%CPEs: 56EXPL: 0CVE-2021-3450 – CA certificate check bypass with X509_V_FLAG_X509_STRICT
https://notcve.org/view.php?id=CVE-2021-3450
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. • http://www.openwall.com/lists/oss-security/2021/03/27/1 http://www.openwall.com/lists/oss-security/2021/03/27/2 http://www.openwall.com/lists/oss-security/2021/03/28/3 http://www.openwall.com/lists/oss-security/2021/03/28/4 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845 https://kc.mc • CWE-295: Improper Certificate Validation •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-5143
https://notcve.org/view.php?id=CVE-2020-5143
SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0. Una página de inicio de sesión SSLVPN de SonicOS, permite a un atacante remoto no autenticado llevar a cabo una enumeración de nombres de usuario administrador de la gestión del firewall basada en las respuestas del servidor. Esta vulnerabilidad afectó a SonicOS Gen 5 versiones 5.9.1.7, 5.9.1.13, Gen 6 versiones 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv versión 6.5.4.v y SonicOS Gen 7 versión 7.0.0.0 • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0018 • CWE-203: Observable Discrepancy •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-5142
https://notcve.org/view.php?id=CVE-2020-5142
A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentially execute arbitrary JavaScript code in the firewall SSLVPN portal. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0. Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en la interfaz web SSLVPN de SonicOS. Un atacante remoto no autenticado puede almacenar y potencialmente ejecutar código JavaScript arbitrario en el portal SSLVPN del firewall. • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0017 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-5141
https://notcve.org/view.php?id=CVE-2020-5141
A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0. Una vulnerabilidad en SonicOS, permite a un atacante remoto no autenticado usar fuerza bruta en el ID de ticket de Virtual Assist en el servicio SSLVPN del firewall. Esta vulnerabilidad afectó a SonicOS Gen 5 versiones 5.9.1.7, 5.9.1.13, Gen 6 versiones 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv versión 6.5.4.v y SonicOS Gen 7 versión 7.0.0.0 • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0016 • CWE-307: Improper Restriction of Excessive Authentication Attempts CWE-799: Improper Control of Interaction Frequency •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-5139
https://notcve.org/view.php?id=CVE-2020-5139
A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of Invalid pointer and leads to a firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0. Una vulnerabilidad en el servicio SSLVPN de SonicOS, permite a un atacante remoto no autenticado causar una Denegación de servicio (DoS) debido a un lanzamiento de un puntero no válido y conlleva a un bloqueo del firewall. Esta vulnerabilidad afectó a SonicOS Gen 5 versiones 5.9.1.7, 5.9.1.13, Gen 6 versiones 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv versión 6.5.4.v y SonicOS Gen 7 versión 7.0.0.0 • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0014 • CWE-763: Release of Invalid Pointer or Reference •