CVE-2020-1887

CRITICAL

osquery 2.9.0-4.2.0 - Improper Certificate Validation

Title source: llm
STIX 2.1

Description

Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.

References (2)

Core 2
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/osquery/osquery/pull/6197
Third Party Advisory x_refsource_confirm
https://www.facebook.com/security/advisories/cve-2020-1887

Scores

CVSS v3 9.1
EPSS 0.0009
EPSS Percentile 25.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-295 CWE-297
Status published
Products (1)
linuxfoundation/osquery 2.9.0 - 4.2.0
Published Mar 13, 2020
Tracked Since Feb 18, 2026