CVE-2010-3901

NameCVE-2010-3901
DescriptionOpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs590873

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openconnect (PTS)buster, buster (security)8.02-1+deb10u1fixed
bullseye8.10-2fixed
bookworm, sid9.01-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openconnectsource(unstable)2.25-0.1590873

Search for package or bug name: Reporting problems