VDB

CVE-2018-21029

CVE-2018-21029 PUBLISHED CVSS 9.800000190734863 CRITICAL

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)

EPSS 3.14% · 87.4th percentile

Risk Scores

CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.14%
87.4th percentile

Affected Products

VendorProductVersions
n/an/an/a
fedoraprojectfedora31
systemd_projectsystemd239

Timeline

  • Oct 30, 2019 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 1, 2022 EPSS Score
  • Jul 5, 2022 EPSS Score
  • Sep 6, 2022 EPSS Score
  • Nov 8, 2022 EPSS Score
  • Jan 10, 2023 EPSS Score
  • Mar 14, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›