CVE-2018-21029 vulnerability in FreeDesktop and Other Products
Published on October 30, 2019
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)
Products Associated with CVE-2018-21029
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-21029 are published in these products:
Exploit Probability
EPSS
1.56%
Percentile
81.22%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.