CVE-2020-15719

MEDIUM 4.2CVE-2020-15719 · Published 14/07/2020 · updated 17/06/2026

In short

CVE-2020-15719 is a MEDIUM (CVSS 4.2) vulnerability affecting policy auditor (mcafee), openldap (openldap), blockchain platform (oracle).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.7% of all vulnerabilities.
Fix: update to 6.5.1, 2.4.46-10.el8, 21.1.2 or later.

Package	Affected versions	Patched versions
policy auditor mcafee	`< 6.5.1`	`6.5.1`
openldap openldap	`< 2.4.46-10.el8`	`2.4.46-10.el8`
blockchain platform oracle	`< 21.1.2`	`21.1.2`

Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

References

lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html · Mailing List
access.redhat.com/errata/RHBA-2019:3674 · Third Party Advisory
bugs.openldap.org/show_bug.cgi · Permissions Required
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
kc.mcafee.com/corporate/index · Third Party Advisory
oracle.com/security-alerts/cpuapr2022.html · Patch

More vulnerabilities in policy auditor

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

policy auditor

mcafee

< 6.5.1

6.5.1

openldap

< 2.4.46-10.el8

2.4.46-10.el8

blockchain platform

oracle

< 21.1.2

21.1.2

More vulnerabilities in policy auditor

See all →