Your submission was sent successfully! Close

CVE-2022-0547

Published: 18 March 2022

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
openvpn
Launchpad, Ubuntu, Debian
bionic
Released (2.4.4-2ubuntu1.7)
focal
Released (2.4.7-1ubuntu2.20.04.4)
impish
Released (2.5.1-3ubuntu1.1)
jammy
Released (2.5.5-1ubuntu3)
kinetic
Released (2.5.5-1ubuntu3)
trusty Needs triage

upstream
Released (2.5.6-1)
xenial Needs triage

Patches:
upstream: https://github.com/OpenVPN/openvpn/commit/58ec3bb4aac77131118dbbc39a65181e7847adee (v2.4.12)
upstream: https://github.com/OpenVPN/openvpn/commit/af3e382649d96ae77cc5e42be8270f355e5cfec5 (v2.5.6)