{"id":"CVE-2020-12823","aliases":["DEBIAN-CVE-2020-12823","DLA-2212-1","EUVD-2020-5106","GHSA-f93c-rq5c-gvpf","MGASA-2020-0251","SUSE-SU-2020:1807-1","SUSE-SU-2020:1930-1","SUSE-SU-2024:0317-1","UBUNTU-CVE-2020-12823","openSUSE-SU-2020:0997-1","openSUSE-SU-2020:1027-1","openSUSE-SU-2024:11114-1"],"status":"published","title":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or...","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04743,"percentile":0.91942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2020-05-12T17:07:15Z","modified":"2026-10-26T12:02:25Z","fixes":[{"ecosystem":"Debian:12","package":"openconnect","fixed_in":["8.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openconnect","fixed_in":["8.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openconnect","fixed_in":["8.10-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"openconnect","fixed_in":["6.00-2+deb8u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"openconnect","fixed_in":["7.08-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"openconnect","fixed_in":["7.08-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"openconnect","fixed_in":["7.08-6.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"openconnect","fixed_in":["7.08-6.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"openconnect","fixed_in":["7.08-lp151.6.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"openconnect","fixed_in":["7.08-lp152.9.4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-2+deb8u2"}]}],"versions":["6.00-2","6.00-2+deb8u1"]},{"source":"osv","ecosystem":"Mageia:7","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.08-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.08-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.08-6.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.08-6.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"oath-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-150000.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"oath-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-150000.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12-150400.15.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"stoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.81-150400.13.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"oath-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-150000.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12-150400.15.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"stoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.81-150400.13.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"oath-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-150000.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.12-150400.15.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"stoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.81-150400.13.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.06-2build1","7.06-2build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.08-1","7.08-2","7.08-3","7.08-3ubuntu0.18.04.1","7.08-3ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.02-1build1","8.05-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.08-lp151.6.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.08-lp152.9.4.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10-2.6"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"infradead","product":"openconnect"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://gitlab.com/openconnect/openconnect/-/merge_requests/108","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://bugs.gentoo.org/721570","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYSXLXAPXD2T73T6JMHI5G2WP7KHAGMN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEVTIH5UFX35CC7MVSYBGRM3D66ACFD5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25MFX4AZE7RDCUWOL4ZOE73YBOPUMQDX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202006-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00039.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00056.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12823"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25MFX4AZE7RDCUWOL4ZOE73YBOPUMQDX/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYSXLXAPXD2T73T6JMHI5G2WP7KHAGMN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEVTIH5UFX35CC7MVSYBGRM3D66ACFD5/"},{"url":"https://github.com/advisories/GHSA-f93c-rq5c-gvpf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-12823","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0251.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26624","tags":["report"]},{"url":"http://www.infradead.org/openconnect/changelog.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201807-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171862","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12823","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201930-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240317-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1140772","tags":["report"]},{"url":"https://bugzilla.suse.com/1157446","tags":["report"]},{"url":"https://bugzilla.suse.com/1170452","tags":["report"]},{"url":"https://bugzilla.suse.com/1215669","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12105","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-12823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12823","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QVAAM5HHI3CZY2NH7XA6UIKOBYCJ3GMU/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JAH5LUZ22G6KZDCULBOOKADOUFIV5COP/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-12823","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","status":"published","published":"2020-05-12T17:07:15Z","modified":"2024-08-04T12:04:22.887Z","updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-5106","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","status":"published","published":"2020-05-12T17:07:15Z","modified":"2024-08-04T12:04:22Z","updated_at":"2026-11-03T03:07:39.298733Z"}],"ghsa":[{"id":"GHSA-f93c-rq5c-gvpf","title":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or...","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","status":"published","published":"2022-05-24T17:17:41Z","modified":"2023-01-27T21:31:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:43:22.817498Z"}],"nvd":[{"id":"CVE-2020-12823","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","status":"published","published":"2020-05-12T18:15:13.473Z","modified":"2026-06-17T02:52:22.64Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-12823","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","status":"published","published":"2020-05-12T18:15:13.473Z","modified":"2026-10-24T10:30:54.330248336Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-12823","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","status":"published","published":"2020-05-12T18:15:13.473Z","modified":"2026-10-26T12:02:25.499483553Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-12823","description":"OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.","status":"published","published":"2020-05-12T18:15:00Z","modified":"2026-04-22T12:28:05.137392Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-2212-1","title":"openconnect - security update","status":"published","published":"2020-05-16T00:00:00Z","modified":"2026-03-09T01:19:00.804036Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0251","title":"Updated openconnect packages fix security vulnerability","description":"Updated openconnect packages fix security vulnerabilities:\n\nOpenConnect through 8.08 mishandles negative return values from\nX509_check_ function calls, which might assist attackers in performing\nman-in-the-middle attacks (CVE-2020-12105).\n\nOpenConnect 8.09 has a buffer overflow, causing a denial of service\n(application crash) or possibly unspecified other impact, via crafted\ncertificate data to get_cert_name in gnutls.c (CVE-2020-12823).\n\nThe openconnect package has been updated to version 8.10, fixing these\nissues and other bugs.  See the upstream changelog for details.\n","status":"published","published":"2020-06-10T22:57:01Z","modified":"2026-04-16T04:41:46.981372255Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0997-1","title":"Security update for openconnect","description":"This update for openconnect fixes the following issues:\n\t  \n- CVE-2020-12823: Fixed a buffer overflow via crafted certificate data which could have led to denial of service (bsc#1171862).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-18T16:28:21Z","modified":"2026-02-04T02:32:07.938362Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:1027-1","title":"Security update for openconnect","description":"This update for openconnect fixes the following issues:\n\t  \n- CVE-2020-12823: Fixed a buffer overflow via crafted certificate data which could have led to denial of service (bsc#1171862).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-21T14:38:41Z","modified":"2026-02-04T02:45:48.492389Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11114-1","title":"libopenconnect5-8.10-2.6 on GA media","description":"These are all security issues fixed in the libopenconnect5-8.10-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:46.015101Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:1807-1","title":"Security update for openconnect","description":"This update for openconnect fixes the following issues:\n\t  \n- CVE-2020-12823: Fixed a buffer overflow via crafted certificate data which could have led to denial of service (bsc#1171862).\n","status":"published","published":"2020-06-30T15:43:59Z","modified":"2026-02-04T02:32:07.878528Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1930-1","title":"Security update for openconnect","description":"This update for openconnect fixes the following issues:\n\t  \n- CVE-2020-12823: Fixed a buffer overflow via crafted certificate data which could have led to denial of service (bsc#1171862).\n","status":"published","published":"2020-07-15T13:05:26Z","modified":"2026-02-04T03:26:28.404835Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2024:0317-1","title":"Security update for openconnect","description":"This update for openconnect fixes the following issues:\n\n- Update to release 9.12:\n\n  * Explicitly reject overly long tun device names.\n  * Increase maximum input size from stdin (#579).\n  * Ignore 0.0.0.0 as NBNS address (!446, vpnc-scripts#58).\n  * Fix stray (null) in URL path after Pulse authentication (4023bd95).\n  * Fix config XML parsing mistake that left GlobalProtect ESP non-working in v9.10 (!475).\n  * Fix case sensitivity in GPST header matching (!474).\n\n- Update to release 9.10:\n\n  * Fix external browser authentication with KDE plasma-nm \u003c 5.26.\n  * Always redirect stdout to stderr when spawning external browser.\n  * Increase default queue length to 32 packets.\n  * Fix receiving multiple packets in one TLS frame, and single packets split across multiple TLS frames, for Array.\n  * Handle idiosyncratic variation in search domain separators for all protocols\n  * Support region selection field for Pulse authentication \n  * Support modified configuration packet from Pulse 9.1R16 servers \n  * Allow hidden form fields to be populated or converted to text fields on the command line\n  * Support yet another strange way of encoding challenge-based 2FA for GlobalProtect\n  * Add --sni option (and corresponding C and Java API functions) to allow domain-fronting connections in censored/filtered network environments\n  * Parrot a GlobalProtect server's software version, if present, as the client version (!333)\n  * Fix NULL pointer dereference that has left Android builds broken since v8.20 (!389).\n  * Fix Fortinet authentication bug where repeated SVPNCOOKIE causes segfaults (#514, !418).\n  * Support F5 VPNs which encode authentication forms only in JSON, not in HTML.\n  * Support simultaneous IPv6 and Legacy IP ('dual-stack') for Fortinet .\n  * Support 'FTM-push' token mode for Fortinet VPNs .\n  * Send IPv6-compatible version string in Pulse IF/T session establishment\n  * Add --no-external-auth option to not advertise external-browser authentication\n  * Many small improvements in server response parsing, and better logging messages and documentation.\n\n- Update to release 9.01:\n\n  * Add support for AnyConnect 'Session Token Re-use Anchor Protocol' (STRAP) \n  * Add support for AnyConnect 'external browser' SSO mode\n  * Bugfix RSA SecurID token decryption and PIN entry forms, broken in v8.20\n  * Support Cisco's multiple-certificate authentication\n  * Revert GlobalProtect default route handling change from v8.20\n  * Suppo split-exclude routes for Fortinet\n  * Add webview callback and SAML/SSO support for AnyConnect, GlobalProtect\n\n- Update to release 8.20:\n\n  * Support non-AEAD ciphersuites in DTLSv1.2 with AnyConnect.\n  * Emulated a newer version of GlobalProtect official clients,\n    5.1.5-8; was 4.0.2-19\n  * Support Juniper login forms containing both password and 2FA\n    token\n  * Explicitly disable 3DES and RC4, unless enabled with\n    --allow-insecure-crypto\n  * Allow protocols to delay tunnel setup and shutdown (!117)\n  * Support for GlobalProtect IPv6\n  * SIGUSR1now causes OpenConnect to log detailed connection\n    information and statistics\n  * Allow --servercert to be specified multiple times in order to\n    accept server certificates matching more than one possible\n    fingerprint\n  * Demangle default routes sent as split routes by GlobalProtect\n  * Support more Juniper login forms, including some SSO forms\n  * Restore compatibility with newer Cisco servers, by no longer\n    sending them the X-AnyConnect-Platform header\n  * Add support for PPP-based protocols, currently over TLS only.\n  * Add support for two PPP-based protocols, F5 with\n    --protocol=f5 and Fortinet with --protocol=fortinet.\n  * Add support for Array Networks SSL VPN.\n  * Support TLSv1.3 with TPMv2 EC and RSA keys, add test cases\n    for swtpm and hardware TPM.\n\n- Import the latest version of the vpnc-script (bsc#1140772)\n\n  * This brings a lot of improvements for non-trivial network setups, IPv6 etc\n\n- Build with --without-gnutls-version-check\n\n- Update to version 8.10:\n\n  * Install bash completion script to\n    ${datadir}/bash-completion/completions/openconnect.\n  * Improve compatibility of csd-post.sh trojan.\n  * Fix potential buffer overflow with GnuTLS describing local\n    certs (CVE-2020-12823, bsc#1171862,\n    gl#openconnect/openconnect!108).\n\n- Introduce subpackage for bash-completion\n\n- Update to 8.09:\n\n  * Add bash completion support.\n  * Give more helpful error in case of Pulse servers asking for\n    TNCC.\n  * Sanitize non-canonical Legacy IP network addresses.\n  * Fix OpenSSL validation for trusted but invalid certificates\n    (CVE-2020-12105 bsc#1170452).\n  * Convert tncc-wrapper.py to Python 3, and include modernized\n    tncc-emulate.py as well. (!91)\n  * Disable Nagle's algorithm for TLS sockets, to improve\n    interactivity when tunnel runs over TCP rather than UDP.\n  * GlobalProtect: more resilient handling of periodic HIP check\n    and login arguments, and predictable naming of challenge forms.\n  * Work around PKCS#11 tokens which forget to set\n    CKF_LOGIN_REQUIRED.\n\n- Update to 8.0.8:\n\n  * Fix check of pin-sha256: public key hashes to be case sensitive\n  * Don't give non-functioning stderr to CSD trojan scripts.\n  * Fix crash with uninitialised OIDC token.\n\n- Update to 8.0.7:\n\n  * Don't abort Pulse connection when server-provided certificate\n    MD5 doesn't match.\n  * Fix off-by-one in check for bad GnuTLS versions, and add build\n    and run time checks.\n  * Don't abort connection if CSD wrapper script returns non-zero\n    (for now).\n  * Make --passtos work for protocols that use ESP, in addition\n    to DTLS.\n  * Convert tncc-wrapper.py to Python 3, and include modernized\n    tncc-emulate.py as well.\n\n- Remove tncc-wrapper.py script as it is python2 only bsc#1157446\n\n- No need to ship hipreport-android.sh as it is intented for\n  android systems only\n\n- Update to 8.0.5:\n\n  * Minor fixes to build on specific platforms\n  * Includes fix for a buffer overflow with chunked HTTP handling\n    (CVE-2019-16239, bsc#1151178) \n\n- Use python3 to generate the web data as now it is supported\n  by upstream\n\n- Update to 8.0.3:\n\n  * Fix Cisco DTLSv1.2 support for AES256-GCM-SHA384.\n  * Fix recognition of OTP password fields.\n\n- Update to 8.02:\n\n  * Fix GNU/Hurd build.\n  * Discover vpnc-script in default packaged location on FreeBSD/OpenBSD.\n  * Support split-exclude routes for GlobalProtect.\n  * Fix GnuTLS builds without libtasn1.\n  * Fix DTLS support with OpenSSL 1.1.1+.\n  * Add Cisco-compatible DTLSv1.2 support.\n  * Invoke script with reason=attempt-reconnect before doing so.\n \n\n- Update to 8.01:\n\n  * Clear form submissions (which may include passwords) before\n    freeing (CVE-2018-20319, bsc#1215669).\n  * Allow form responses to be provided on command line.\n  * Add support for SSL keys stored in TPM2.\n  * Fix ESP rekey when replay protection is disabled.\n  * Drop support for GnuTLS older than 3.2.10.\n  * Fix --passwd-on-stdin for Windows to not forcibly open console.\n  * Fix portability of shell scripts in test suite.\n  * Add Google Authenticator TOTP support for Juniper.\n  * Add RFC7469 key PIN support for cert hashes.\n  * Add protocol method to securely log out the Juniper session.\n  * Relax requirements for Juniper hostname packet response to support old gateways.\n  * Add API functions to query the supported protocols.\n  * Verify ESP sequence numbers and warn even if replay protection is disabled.\n  * Add support for PAN GlobalProtect VPN protocol (--protocol=gp).\n  * Reorganize listing of command-line options, and include information on supported protocols.\n  * SIGTERM cleans up the session similarly to SIGINT.\n  * Fix memset_s() arguments.\n  * Fix OpenBSD build.\n\n- Explicitely enable all the features as needed to stop build if\n  something is missing\n","status":"published","published":"2024-02-02T09:35:06Z","modified":"2026-02-04T03:43:17.365277Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}