GCVE - cpe:2.3:a:openfortivpn_project:openfortivpn:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openfortivpn_project:openfortivpn:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Openfortivpn Project (`d93e9e06-0c9f-514b-a89b-1d4d83a4c122`)
Product	Openfortivpn (`2564d169-726d-5265-b289-4e92acb1eeb9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/openfortivpn`	purl2cpe	2026-06-01 10:11:59.041896
`pkg:deb/ubuntu/openfortivpn`	purl2cpe	2026-06-01 10:11:59.041899
`pkg:github/adrienverge/openfortivpn`	purl2cpe	2026-06-01 10:11:59.041902
`pkg:rpm/fedora/openfortivpn`	purl2cpe	2026-06-01 10:11:59.041905
`pkg:rpm/opensuse/openfortivpn`	purl2cpe	2026-06-01 10:11:59.041908

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-7043`	vulnerable	2026-06-08 05:27:11.812045	Details available An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack. Published: 2020-02-27T17:30:51.000Z Updated: 2024-08-04T09:18:03.013Z Open on db.gcve.eu Reference links https://github.com/adrienverge/openfortivpn/issues/536 https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4 http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SRVVNXCNTNMPCIAZIVR4FAGYCSU53FNA/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-7042`	vulnerable	2026-06-08 05:27:11.810367	Details available An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted). Published: 2020-02-27T17:30:16.000Z Updated: 2024-08-04T09:18:02.510Z Open on db.gcve.eu Reference links https://github.com/adrienverge/openfortivpn/issues/536 https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4 http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SRVVNXCNTNMPCIAZIVR4FAGYCSU53FNA/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-7041`	vulnerable	2026-06-08 05:27:11.804652	Details available An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value. Published: 2020-02-27T17:29:38.000Z Updated: 2024-08-04T09:18:02.548Z Open on db.gcve.eu Reference links https://github.com/adrienverge/openfortivpn/issues/536 https://github.com/adrienverge/openfortivpn/commit/cd9368c6a1b4ef91d77bb3fdbe2e5bc34aa6f4c4 http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SRVVNXCNTNMPCIAZIVR4FAGYCSU53FNA/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Openfortivpn

Notes

PURL mappings

Vulnerability references

Contribute