CVE-2020-13614 Security feature bypass in n/a
Axel lacks TLS hostname verification, allowing attackers to bypass security checks and potentially intercept or manipulate data during downloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13614?
CVE-2020-13614 is a medium-severity vulnerability in Fedoraproject Fedora, published on 26 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
Weakness: CWE-295
Which versions are affected by CVE-2020-13614?
It affects 4 products.
Linux distribution packages (3)
axel SUSE:Package Hub 15 SP1 | All versions | 2.17.8-bp151.4.3.1 |
axel openSUSE:Leap 15.1 | All versions | 2.17.8-lp151.3.3.1 |
axel openSUSE:Tumbleweed | All versions | 2.17.10-1.6 |
Products include Axel Project Axel, Fedoraproject Fedora, Opensuse Backports Sle, Opensuse Leap.
How do I fix CVE-2020-13614?
Upgrade to a fixed version.
Is CVE-2020-13614 being exploited?
There is no known exploitation of CVE-2020-13614 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2020-13614, DEBIAN-CVE-2020-13614, GHSA-xcp5-2g2r-h36p, MGASA-2020-0263, UBUNTU-CVE-2020-13614, USN-4872-1 and 3 more.