{"id":"CVE-2020-15078","aliases":["ALPINE-CVE-2020-15078","CLSA-2025-1759337779","CLSA-2025-1759485890","DEBIAN-CVE-2020-15078","DLA-2992-1","EUVD-2020-7206","GHSA-r2jp-995w-h282","MGASA-2021-0302","OESA-2021-1197","SUSE-SU-2021:14723-1","SUSE-SU-2021:1576-1","SUSE-SU-2021:1577-1","UBUNTU-CVE-2020-15078","USN-4933-1","openSUSE-SU-2021:0734-1","openSUSE-SU-2024:11128-1"],"status":"published","title":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access...","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04948,"percentile":0.92222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-305","CWE-306"],"published":"2021-04-26T13:19:45Z","modified":"2026-10-26T12:00:41Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"openvpn","fixed_in":["2.4.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openvpn","fixed_in":["2.4.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openvpn","fixed_in":["2.4.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openvpn","fixed_in":["2.5.2-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"openvpn","fixed_in":["2.4.9-1.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"openvpn-devel","fixed_in":["2.4.9-1.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"openvpn","fixed_in":["2.4.9-1.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"openvpn-devel","fixed_in":["2.4.9-1.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openvpn","fixed_in":["2.5.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openvpn","fixed_in":["2.5.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openvpn","fixed_in":["2.5.1-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"openvpn","fixed_in":["2.4.9-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"openvpn","fixed_in":["2.5.0-2.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"openvpn","fixed_in":["2.4.8-7.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openvpn","fixed_in":["2.4.4-2ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"openvpn","fixed_in":["2.4.7-1ubuntu2.20.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.4.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.4.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.4.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"openvpn-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openvpn-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-6+deb9u4"}]}],"versions":["2.4.0-6","2.4.0-6+deb9u1","2.4.0-6+deb9u1~bpo8+1","2.4.0-6+deb9u2","2.4.0-6+deb9u3"],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-2.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-7.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openvpn-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-0.10.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-5.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-5.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu1.5"}]}],"versions":["2.4.3-4ubuntu1","2.4.4-1ubuntu1","2.4.4-2ubuntu1","2.4.4-2ubuntu1.1","2.4.4-2ubuntu1.2","2.4.4-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu2.20.04.2"}]}],"versions":["2.4.7-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu1.5"}]}],"versions":["2.4.3-4ubuntu1","2.4.4-1ubuntu1","2.4.4-2ubuntu1","2.4.4-2ubuntu1.1","2.4.4-2ubuntu1.2","2.4.4-2ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu2.20.04.2"}]}],"versions":["2.4.7-1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-lp152.6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-1.2"}]}],"bundled":10}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openvpn","product":"openvpn"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://community.openvpn.net/openvpn/wiki/CVE-2020-15078","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202105-25","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/usn/usn-4933-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15078","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/"},{"url":"https://github.com/advisories/GHSA-r2jp-995w-h282"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-15078","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2025-1759337779.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2025-1759485890.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15078","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0302.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29007","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4933-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1197","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114723-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1085803","tags":["report"]},{"url":"https://bugzilla.suse.com/1185279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15078","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211576-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211577-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1169925","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11810","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11810","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/C5VK3H4AGK4ZRCLIB2D3IB7SS5RI4AZK/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-4339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9336","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15078","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2021-04-26T13:19:45Z","modified":"2024-08-04T13:08:21.675Z","cwes":["CWE-305"],"updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-7206","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2021-04-26T13:19:45Z","modified":"2024-08-04T13:08:21Z","updated_at":"2026-11-03T03:07:33.100327Z"}],"ghsa":[{"id":"GHSA-r2jp-995w-h282","title":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access...","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2022-05-24T17:48:48Z","modified":"2023-01-27T05:03:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-287","CWE-306"],"updated_at":"2026-11-02T14:42:20.947965Z"}],"nvd":[{"id":"CVE-2020-15078","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2021-04-26T14:15:08.623Z","modified":"2026-06-17T02:56:00.88Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-305","CWE-306"],"updated_at":"2026-11-02T14:06:39.25999Z"}],"osv":[{"id":"ALPINE-CVE-2020-15078","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2021-04-26T14:15:08.623Z","modified":"2026-10-26T11:17:55.129025268Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-15078","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2021-04-26T14:15:08.623Z","modified":"2026-10-24T10:30:48.392173167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-15078","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2021-04-26T14:15:08.623Z","modified":"2026-10-26T12:00:41.829919002Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"OESA-2021-1197","title":"openvpn security update","description":"OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations,  including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing,  failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security,  OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.\r\n\r\nSecurity Fix(es):\r\n\r\nOpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.(CVE-2020-15078)","status":"published","published":"2021-05-30T11:04:26Z","modified":"2026-08-18T01:15:41.224497077Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-15078","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.","status":"published","published":"2021-04-26T14:15:00Z","modified":"2026-02-04T02:55:38.625427Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"CLSA-2025-1759337779","title":"openvpn: Fix of CVE-2020-15078","description":"- CVE-2020-15078: fix authentication bypass and access to control channel data on\n  servers configured with deferred authentication","status":"published","published":"2025-10-01T16:56:25Z","modified":"2026-06-01T00:33:25.845380149Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1759485890","title":"openvpn: Fix of CVE-2020-15078","description":"- CVE-2020-15078: fix authentication bypass and access to control channel data on\n  servers configured with deferred authentication","status":"published","published":"2025-10-03T10:04:59Z","modified":"2026-06-01T00:33:16.581418186Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-2992-1","title":"openvpn - security update","status":"published","published":"2022-05-03T00:00:00Z","modified":"2026-03-09T01:20:24.861872Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2021-0302","title":"Updated openvpn packages fix a security vulnerability","description":"OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass\nauthentication and access control channel data on servers configured with\ndeferred authentication, which can be used to potentially trigger further\ninformation leaks (CVE-2020-15078).\n","status":"published","published":"2021-06-29T17:31:40Z","modified":"2026-04-16T04:41:16.042981071Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0734-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).\n- CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key (bsc#1169925).\n- CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-05-15T16:04:52Z","modified":"2026-02-04T02:56:05.067112Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11128-1","title":"openvpn-2.5.3-1.2 on GA media","description":"These are all security issues fixed in the openvpn-2.5.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:06.953443Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:14723-1","title":"Security update for openvpn-openssl1","description":"This update for openvpn-openssl1 fixes the following issues:\n\n- CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).\n- CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).\n","status":"published","published":"2021-05-12T10:05:49Z","modified":"2026-02-04T04:19:47.893267Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1576-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).\n- CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).\n","status":"published","published":"2021-05-12T10:06:05Z","modified":"2026-02-04T02:52:20.63132Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1577-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).\n- CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key (bsc#1169925).\n- CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).\n","status":"published","published":"2021-05-12T10:07:01Z","modified":"2026-02-04T02:40:50.107091Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4933-1","title":"openvpn vulnerabilities","description":"It was discovered that OpenVPN incorrectly handled certain data channel v2\npackets. A remote attacker could possibly use this issue to inject packets\nusing a victim's peer-id. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-11810)\n\nIt was discovered that OpenVPN incorrectly handled deferred authentication.\nWhen a server is configured to use deferred authentication, a remote\nattacker could possibly use this issue to bypass authentication and access\ncontrol channel data. (CVE-2020-15078)\n","status":"published","published":"2021-05-04T11:59:09Z","modified":"2026-02-10T04:42:09Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}