Medium
Security advisory
OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-12105
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:21 UTC · Revision 1
Source evidence
OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.
osv:CVE-2020-12105
Complete source record
{
"id": "f1d0c409ef1661625aff679ffc23f44564008f7492a4b40fc51d984baef33e10",
"url": "https://osv.dev/vulnerability/CVE-2020-12105",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-12105",
"summary": "OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks.",
"evidence": "osv:CVE-2020-12105",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-12105",
"aliases": [
"CVE-2020-12105"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openconnect/openconnect",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "a73743d13e4c75ea19635f8e725907b7cd8477f8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:infradead:openconnect:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "8.08"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v8.08",
"v8.07",
"v8.06",
"v8.05",
"v8.04",
"v8.03",
"v8.02",
"v8.01",
"v8.00",
"v7.08",
"v7.07",
"v7.06",
"v7.05",
"v7.04",
"v7.03",
"v7.02",
"v7.01",
"v7.00",
"v6.00",
"v5.99",
"v5.03",
"v5.02",
"v5.01",
"v5.00",
"v4.99",
"v4.07",
"v4.06",
"v4.05",
"v4.04",
"v4.03",
"v4.02",
"v4.01",
"v4.00",
"v3.99",
"v3.20",
"v3.19",
"v3.18",
"v3.17",
"v3.16",
"v3.15",
"v3.14",
"v3.13",
"v3.12",
"v3.11",
"v3.10",
"v3.02",
"v3.01",
"v3.00",
"v2.26",
"v2.25",
"v2.24",
"v2.23",
"v2.22",
"v2.21",
"v2.20",
"v2.12",
"v2.11",
"v2.10",
"v2.01",
"v2.00",
"v1.40",
"v1.30",
"v1.20",
"v1.10",
"v1.00",
"v0.99",
"v0.98",
"v0.97",
"v0.96",
"v0.95",
"v0.94",
"v0.93",
"v0.92",
"v0.91",
"v0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12105.json"
}
}
],
"modified": "2026-10-24T10:30:52.177264582Z",
"provider": "osv",
"references": [
"https://gitlab.com/openconnect/openconnect/-/merge_requests/96",
"https://security.gentoo.org/glsa/202006-15"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-12105",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437642,
"published_at": "2020-04-23T17:15:12.863+00:00"
}