[ GLSA 202105-25 ] OpenVPN

[GLSA]

Gentoo Linux Security Advisory

Title: OpenVPN: Authentication bypass (GLSA 202105-25)
Severity: normal
Exploitable: remote
Date: 2021-05-26
Bug(s): #785115
ID: 202105-25

Synopsis

A vulnerability has been found in OpenVPN, allowing attackers to
bypass the authentication process.


Background

OpenVPN is a multi-platform, full-featured SSL VPN solution.

Affected Packages

Package: net-vpn/openvpn
Vulnerable: < 2.5.2
Unaffected: >= 2.5.2
Architectures: All supported architectures


Description

It was discovered that OpenVPN incorrectly handled deferred
authentication.


Impact

A remote attacker could bypass authentication and access control channel
data and trigger further information leaks.


Workaround

Configure OpenVPN server to not use deferred authentication.

Resolution

All OpenVPN users should upgrade to the latest version: