OESA-2022-1612

Dashboard / Vulnerabilities / OESA-2022-1612

OESA-2022-1612

Summary: openvpn security update

Details: OpenVPN can be extended through the --plugin option, which provides possibilities to add specialized authentication, user accounting, packet filtering and related features. These plug-ins need to be written in C and provides a more low-level and information rich access to similar features as the various script-hooks. Security Fix(es): OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.(CVE-2022-0547)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1612, https://nvd.nist.gov/vuln/detail/CVE-2022-0547