CVE-2020-13614
Published: 26 May 2020
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
Priority
Medium
CVSS 3 base score: 5.9
Status
| Package | Release | Status |
|---|---|---|
|
axel Launchpad, Ubuntu, Debian |
Upstream |
Released
(2.17.8-1)
|
| Ubuntu 21.04 (Hirsute Hippo) |
Needed
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Needed
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Needed
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Not vulnerable
(code not present)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Not vulnerable
(code not present)
|
|
|
Patches: Upstream: https://github.com/axel-download-accelerator/axel/commit/961cf5408baf17944edab2bf771afb90471c4262 |
||
Notes
| Author | Note |
|---|---|
| sbeattie | if addressing this issue, may also want to add wildcard hostname support as described in axel github issue 271 |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13614
- https://github.com/axel-download-accelerator/axel/issues/262
- https://github.com/axel-download-accelerator/axel/releases/tag/v2.17.8
- NVD
- Launchpad
- Debian