CVE-2020-12105

Updated openconnect packages fix security vulnerabilities:

OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attacks (CVE-2020-12105).

OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c (CVE-2020-12823).

The openconnect package has been updated to version 8.10, fixing these issues and other bugs. See the upstream changelog for details.

This update for openconnect fixes the following issues:

Security issue fixed:

• CVE-2020-12105: Fixed the improper handling of negative return values from X509_check_ function calls that might have allowed MITM attacks (bsc#1170452).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libopenconnect5-8.10-2.6 package on the GA media of openSUSE Tumbleweed.

This update for openconnect fixes the following issue:

Security issue fixed:

• CVE-2020-12105: Fixed the improper handling of negative return values from X509_check_ function calls that might have allowed MITM attacks (bsc#1170452).

Non-security issue fixed:

• This is a rebuild to have a higher version than openconnect on Packagehub, to avoid having a vpnc dependency. (bsc#1142093)
• A vpnc-script is included in this openconnect package.

This update for openconnect fixes the following issues:

Security issue fixed:

• CVE-2020-12105: Fixed the improper handling of negative return values from X509_check_ function calls that might have allowed MITM attacks (bsc#1170452).

This update for openconnect fixes the following issues:

• Update to release 9.12:

  • Explicitly reject overly long tun device names.
  • Increase maximum input size from stdin (#579).
  • Ignore 0.0.0.0 as NBNS address (!446, vpnc-scripts#58).
  • Fix stray (null) in URL path after Pulse authentication (4023bd95).
  • Fix config XML parsing mistake that left GlobalProtect ESP non-working in v9.10 (!475).
  • Fix case sensitivity in GPST header matching (!474).

• Update to release 9.10:

  • Fix external browser authentication with KDE plasma-nm < 5.26.
  • Always redirect stdout to stderr when spawning external browser.
  • Increase default queue length to 32 packets.
  • Fix receiving multiple packets in one TLS frame, and single packets split across multiple TLS frames, for Array.
  • Handle idiosyncratic variation in search domain separators for all protocols
  • Support region selection field for Pulse authentication
  • Support modified configuration packet from Pulse 9.1R16 servers
  • Allow hidden form fields to be populated or converted to text fields on the command line
  • Support yet another strange way of encoding challenge-based 2FA for GlobalProtect
  • Add --sni option (and corresponding C and Java API functions) to allow domain-fronting connections in censored/filtered network environments
  • Parrot a GlobalProtect server's software version, if present, as the client version (!333)
  • Fix NULL pointer dereference that has left Android builds broken since v8.20 (!389).
  • Fix Fortinet authentication bug where repeated SVPNCOOKIE causes segfaults (#514, !418).
  • Support F5 VPNs which encode authentication forms only in JSON, not in HTML.
  • Support simultaneous IPv6 and Legacy IP ('dual-stack') for Fortinet .
  • Support 'FTM-push' token mode for Fortinet VPNs .
  • Send IPv6-compatible version string in Pulse IF/T session establishment
  • Add --no-external-auth option to not advertise external-browser authentication
  • Many small improvements in server response parsing, and better logging messages and documentation.

• Update to release 9.01:

  • Add support for AnyConnect 'Session Token Re-use Anchor Protocol' (STRAP)
  • Add support for AnyConnect 'external browser' SSO mode
  • Bugfix RSA SecurID token decryption and PIN entry forms, broken in v8.20
  • Support Cisco's multiple-certificate authentication
  • Revert GlobalProtect default route handling change from v8.20
  • Suppo split-exclude routes for Fortinet
  • Add webview callback and SAML/SSO support for AnyConnect, GlobalProtect

• Update to release 8.20:

  • Support non-AEAD ciphersuites in DTLSv1.2 with AnyConnect.
  • Emulated a newer version of GlobalProtect official clients, 5.1.5-8; was 4.0.2-19
  • Support Juniper login forms containing both password and 2FA token
  • Explicitly disable 3DES and RC4, unless enabled with --allow-insecure-crypto
  • Allow protocols to delay tunnel setup and shutdown (!117)
  • Support for GlobalProtect IPv6
  • SIGUSR1now causes OpenConnect to log detailed connection information and statistics
  • Allow --servercert to be specified multiple times in order to accept server certificates matching more than one possible fingerprint
  • Demangle default routes sent as split routes by GlobalProtect
  • Support more Juniper login forms, including some SSO forms
  • Restore compatibility with newer Cisco servers, by no longer sending them the X-AnyConnect-Platform header
  • Add support for PPP-based protocols, currently over TLS only.
  • Add support for two PPP-based protocols, F5 with --protocol=f5 and Fortinet with --protocol=fortinet.
  • Add support for Array Networks SSL VPN.
  • Support TLSv1.3 with TPMv2 EC and RSA keys, add test cases for swtpm and hardware TPM.

• Import the latest version of the vpnc-script (bsc#1140772)

  • This brings a lot of improvements for non-trivial network setups, IPv6 etc

• Build with --without-gnutls-version-check

• Update to…