CVE-2020-7042

An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).

• CWE-295
• CWE-908

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.htmlMailing List, Third Party Advisory
• https://github.com/adrienverge/openfortivpn/commit/9eee997d599a89492281fc7ffdd79d88cd61afc3Patch, Third Party Advisory
• https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4Patch, Third Party Advisory
• https://github.com/adrienverge/openfortivpn/issues/536Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKNKSGBVYGRRVRLFEFBEKUEJYJR5LWOF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FF6HYIBREQGATRM5COF57MRQWKOKCWZ3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SRVVNXCNTNMPCIAZIVR4FAGYCSU53FNA/
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.htmlMailing List, Third Party Advisory
• https://github.com/adrienverge/openfortivpn/commit/9eee997d599a89492281fc7ffdd79d88cd61afc3Patch, Third Party Advisory
• https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4Patch, Third Party Advisory
• https://github.com/adrienverge/openfortivpn/issues/536Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKNKSGBVYGRRVRLFEFBEKUEJYJR5LWOF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FF6HYIBREQGATRM5COF57MRQWKOKCWZ3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SRVVNXCNTNMPCIAZIVR4FAGYCSU53FNA/

Published

Feb 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7036An XML External Entities (XXE)vulnerability in Callback Assi…6.5
• CVE-2020-7037An XML External Entities (XXE) vulnerability in Media Server…8.1
• CVE-2020-7038A vulnerability was discovered in Management component of Av…7.5
• CVE-2020-7039tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2…5.6
• CVE-2020-7040storeBackup.pl in storeBackup through 3.5 relies on the /tmp…8.1
• CVE-2020-7041An issue was discovered in openfortivpn 1.11.0 when used wit…5.3
• CVE-2020-7043An issue was discovered in openfortivpn 1.11.0 when used wit…9.1
• CVE-2020-7044In Wireshark 3.2.x before 3.2.1, the WASSP dissector could c…7.5
• CVE-2020-7045In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could …6.5
• CVE-2020-7046lib-smtp in submission-login and lmtp in Dovecot 2.3.9 befor…7.5
• CVE-2020-7047The WordPress plugin, WP Database Reset through 3.1, contain…8.8
• CVE-2020-7048The WordPress plugin, WP Database Reset through 3.1, contain…9.1