CVE-2020-15078
26.04.2021, 14:15
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openvpn | openvpn | 𝑥 < 2.4.11 |
| openvpn | openvpn | 2.5.0 ≤ 𝑥 < 2.5.2 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 20.04 |
| canonical | ubuntu_linux | 20.10 |
| canonical | ubuntu_linux | 21.04 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| openvpn |
| ||||||||||||||||||||||||||||||||||||||||||
| openvpn-auth-pam-plugin |
| ||||||||||||||||||||||||||||||||||||||||||
| openvpn-dco |
| ||||||||||||||||||||||||||||||||||||||||||
| openvpn-dco-devel |
| ||||||||||||||||||||||||||||||||||||||||||
| openvpn-devel |
|
Common Weakness Enumeration
- CWE-305 - Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- CWE-306 - Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
References