CVE-2020-9434 - openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values

Back Back to CVE browser

CRITICAL

openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values

Published Feb 27, 2020

9.1

CRITICAL

CVSS 3.1

EPSS 0.84%

Description

openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30254
Advisory
https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30254		Advisory
https://github.com/zhaozg/lua-openssl/commit/a6dc186dd4b6b9e329a93cca3e7e3cfccfdf3cca		x_refsource_MISCPatchThird Party Advisory