CVE-2020-15078

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.(CVE-2020-15078)

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

• CVE-2020-15078: fix authentication bypass and access to control channel data on servers configured with deferred authentication

• CVE-2020-15078: fix authentication bypass and access to control channel data on servers configured with deferred authentication

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks (CVE-2020-15078).

This update for openvpn fixes the following issues:

• CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).
• CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key (bsc#1169925).
• CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the openvpn-2.5.3-1.2 package on the GA media of openSUSE Tumbleweed.

This update for openvpn-openssl1 fixes the following issues:

• CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).
• CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).

This update for openvpn fixes the following issues:

• CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).
• CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).

This update for openvpn fixes the following issues:

• CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).
• CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key (bsc#1169925).
• CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).

It was discovered that OpenVPN incorrectly handled certain data channel v2 packets. A remote attacker could possibly use this issue to inject packets using a victim's peer-id. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-11810)

It was discovered that OpenVPN incorrectly handled deferred authentication. When a server is configured to use deferred authentication, a remote attacker could possibly use this issue to bypass authentication and access control channel data. (CVE-2020-15078)