CVE-2020-1887

State: Published
Severity: Not scored
Published: Mar 12, 2020
Updated: Aug 4, 2024
Reserved: Dec 2, 2019

Description

Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.

Scores

The record has no CVSS score.

Weaknesses

CWE-297 Improper Validation of Certificate with Host Mismatch (CWE-297)

Affected Products

Product	Versions
OsqueryFacebook	4.2.0Affected next of 2.9.0 to before unspecifiedAffected 2.9.0Affected

References

https://github.com/osquery/osquery/pull/6197
https://www.facebook.com/security/advisories/cve-2020-1887

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.