CVE-2022-0547
Published: 18 March 2022
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
Priority
CVSS 3 base score: 9.8
Status
| Package | Release | Status |
|---|---|---|
|
openvpn Launchpad, Ubuntu, Debian |
bionic |
Released
(2.4.4-2ubuntu1.7)
|
| focal |
Released
(2.4.7-1ubuntu2.20.04.4)
|
|
| impish |
Released
(2.5.1-3ubuntu1.1)
|
|
| jammy |
Released
(2.5.5-1ubuntu3)
|
|
| kinetic |
Released
(2.5.5-1ubuntu3)
|
|
| trusty |
Needs triage
|
|
| upstream |
Released
(2.5.6-1)
|
|
| xenial |
Needs triage
|
|
|
Patches: upstream: https://github.com/OpenVPN/openvpn/commit/58ec3bb4aac77131118dbbc39a65181e7847adee (v2.4.12) upstream: https://github.com/OpenVPN/openvpn/commit/af3e382649d96ae77cc5e42be8270f355e5cfec5 (v2.5.6) |
||