SA43620 - 2018-01 Out-Of-Cycle Advisory : Pulse Secure Desktop Linux Client - SSL Certificate Validation Issue

The Pulse Linux GUI component does not perform strict SSL certificate validation which allows the attacker to manipulate the Pulse connection set.
 
This issue is applicable only Pulse Secure Desktop Linux clients versions:

• PULSE5.3R4.1 and lower
• PULSE5.2R9.1 and lower

 
CVE-2018-6374 has been assigned to it.

This issue is resolved in the following Pulse Secure Desktop Linux client releases:
 
PULSE5.3R4.2 Software (Build 639) is now available for download on Pulse Secure Licensing and Download Center
PULSE5.2R9.2 Software (Build 638) is now available for download on Pulse Secure Licensing and Download Center
 
Version History:

January 30, 2018 - Fixed versions PULSE5.3R4.2 & PULSE5.2R9.2 released.
March 5, 2018 - Change to applicable software versions

This vulnerability was discovered and responsibly reported to Pulse Secure by Will Dormann (CERT Coordination Center)