Vulnerability CVE-2022-0547: Information

Description

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published: March 18, 2022
Modified: Nov. 7, 2023
Error type identifier: CWE-287

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
openvpnsisyphus2.5.6-alt12.6.8-alt1ALT-PU-2022-1915-1300360Fixed
openvpnsisyphus_e2k2.5.6-alt12.6.8-alt1ALT-PU-2022-5040-1-Fixed
openvpnsisyphus_mipsel2.5.6-alt12.5.8-alt1ALT-PU-2022-5033-1-Fixed
openvpnsisyphus_riscv642.5.6-alt12.6.8-alt1ALT-PU-2022-5035-1-Fixed
openvpnp102.5.6-alt12.5.6-alt1ALT-PU-2022-1936-1300403Fixed
openvpnp10_e2k2.5.6-alt12.5.6-alt1ALT-PU-2022-5085-1-Fixed
openvpnp92.5.6-alt12.5.6-alt1ALT-PU-2022-2690-1305924Fixed
openvpnp9_e2k2.5.6-alt12.5.6-alt1ALT-PU-2022-6432-1-Fixed
openvpnp9_mipsel2.5.6-alt12.5.6-alt1ALT-PU-2022-6617-1-Fixed
openvpnc10f12.5.6-alt12.5.6-alt1ALT-PU-2022-1936-1300403Fixed
openvpnc9f22.4.9-alt1.c9f2.22.4.9-alt1.c9f2.2ALT-PU-2022-2268-1299848Fixed

References to Advisories, Solutions, and Tools

    1. Configuration 1

      cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*
      Start including
      2.5.0
      End excliding
      2.5.6

      cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*
      Start including
      2.1.0
      End excliding
      2.4.12

      Configuration 2

      cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

      cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*