iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.
References
Link | Resource |
---|---|
https://ftp.openbsd.org/pub/OpenBSD/patches/6.7/common/014_iked.patch.sig | Exploit Vendor Advisory |
https://github.com/openbsd/src/commit/7afb2d41c6d373cf965285840b85c45011357115 | Patch Third Party Advisory |
https://github.com/xcllnt/openiked/commits/master | Patch Third Party Advisory |
https://www.openiked.org/security.html | Vendor Advisory |
Configurations
History
04 Jan 2022, 16:32
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-287 | |
References | (MISC) https://github.com/openbsd/src/commit/7afb2d41c6d373cf965285840b85c45011357115 - Patch, Third Party Advisory |
Information
Published : 2020-07-28 12:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-16088
Mitre link : CVE-2020-16088
CVE.ORG link : CVE-2020-16088
JSON object : View
Products Affected
openbsd
- openbsd
CWE
CWE-287
Improper Authentication