Candidate: CVE-2010-3901
PublicDate: 2010-10-14 05:58:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3901
Description:
 OpenConnect before 2.25 does not properly validate X.509 certificates,
 which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL
 VPN servers via a crafted server certificate that (1) does not correspond
 to the server hostname or (2) is presented in circumstances involving a
 missing --cafile configuration option.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_openconnect:
upstream_openconnect: released (2.25-0.1)
dapper_openconnect: DNE
hardy_openconnect: DNE
jaunty_openconnect: DNE
karmic_openconnect: ignored (reached end-of-life)
lucid_openconnect: ignored (reached end-of-life)
maverick_openconnect: ignored (reached end-of-life)
natty_openconnect: not-affected (2.25-0.1)
oneiric_openconnect: not-affected (2.25-0.1)
precise_openconnect: not-affected (2.25-0.1)
quantal_openconnect: not-affected (2.25-0.1)
raring_openconnect: not-affected (2.25-0.1)
saucy_openconnect: not-affected (2.25-0.1)
devel_openconnect: not-affected (2.25-0.1)