CVE - CVE-2020-26117

CVE-ID
CVE-2020-26117	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://bugzilla.opensuse.org/show_bug.cgi?id=1176733 MISC:https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb MISC:https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b MISC:https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba MISC:https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e MISC:https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0 MLIST:[debian-lts-announce] 20201006 [SECURITY] [DLA 2396-1] tigervnc security update URL:https://lists.debian.org/debian-lts-announce/2020/10/msg00007.html SUSE:openSUSE-SU-2020:1666 URL:http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.html SUSE:openSUSE-SU-2020:1841 URL:http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00024.html
Assigning CNA
MITRE Corporation
Date Record Created
20200927	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20200927)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)