Critical severity · published Mar 13, 2020
CVE-2020-1887
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root…
9.1
CVSS
1.6%
EPSS
No
On KEV
Description
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Osquery · Linuxfoundation
after 2.9.0 before 4.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1887
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1887
Patch
https://github.com/osquery/osquery/pull/6197
Third Party Advisory
https://www.facebook.com/security/advisories/cve-2020-1887
More from Osquery
8.2
CVE-2020-11081
osquery before version 4.4.0 enables a privilege escalation vulnerability
8.1
CVE-2019-3567
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with…
7.8
CVE-2018-6336
An issue was discovered in osquery
5.2
CVE-2020-26273
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework