CVE-2022-0547

NameCVE-2022-0547
DescriptionOpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2992-1
Debian Bugs1008015

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openvpn (PTS)bullseye2.5.1-3vulnerable
bookworm, bookworm (security)2.6.3-1+deb12u2fixed
sid, trixie2.6.12-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openvpnsourcestretch2.4.0-6+deb9u4DLA-2992-1
openvpnsource(unstable)2.5.6-11008015

Notes

[bullseye] - openvpn <no-dsa> (Minor issue)
[buster] - openvpn <no-dsa> (Minor issue)
https://community.openvpn.net/openvpn/wiki/CVE-2022-0547
https://github.com/OpenVPN/openvpn/commit/58ec3bb4aac77131118dbbc39a65181e7847adee (v2.4.12)
https://github.com/OpenVPN/openvpn/commit/af3e382649d96ae77cc5e42be8270f355e5cfec5 (v2.5.6)

Search for package or bug name: Reporting problems