CVE-2021-3547
12.07.2021, 11:15
OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration.Enginsight
| Vendor | Product | Version |
|---|---|---|
| openvpn | openvpn | 3.6 |
| openvpn | openvpn | 3.6.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-305 - Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- CWE-295 - Improper Certificate ValidationThe software does not validate, or incorrectly validates, a certificate.