- Vulnerability/
- USN-4933-1
USN-4933-1: OpenVPN vulnerabilities
First published: Tue May 04 2021(Updated: )
It was discovered that OpenVPN incorrectly handled certain data channel v2 packets. A remote attacker could possibly use this issue to inject packets using a victim's peer-id. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-11810) It was discovered that OpenVPN incorrectly handled deferred authentication. When a server is configured to use deferred authentication, a remote attacker could possibly use this issue to bypass authentication and access control channel data. (CVE-2020-15078)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/openvpn | <2.5.1-1ubuntu1.1 | 2.5.1-1ubuntu1.1 |
| Ubuntu Ubuntu | =21.04 | |
| All of | ||
| ubuntu/openvpn | <2.4.9-3ubuntu1.1 | 2.4.9-3ubuntu1.1 |
| Ubuntu Ubuntu | =20.10 | |
| All of | ||
| ubuntu/openvpn | <2.4.7-1ubuntu2.20.04.2 | 2.4.7-1ubuntu2.20.04.2 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/openvpn | <2.4.4-2ubuntu1.5 | 2.4.4-2ubuntu1.5 |
| Ubuntu Ubuntu | =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2020-15078
- https://ubuntu.com/security/CVE-2020-11810
- https://launchpad.net/ubuntu/+source/openvpn/2.5.1-1ubuntu1.1
- https://launchpad.net/ubuntu/+source/openvpn/2.4.9-3ubuntu1.1
- https://launchpad.net/ubuntu/+source/openvpn/2.4.7-1ubuntu2.20.04.2
- https://launchpad.net/ubuntu/+source/openvpn/2.4.4-2ubuntu1.5
- https://ubuntu.com/security/notices/USN-4933-1 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this OpenVPN vulnerability?
The vulnerability ID for this OpenVPN vulnerability is CVE-2020-11810.
Which versions of Ubuntu are affected by this OpenVPN vulnerability?
This OpenVPN vulnerability affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
How can a remote attacker exploit this OpenVPN vulnerability?
A remote attacker could potentially exploit this OpenVPN vulnerability by injecting packets using a victim's peer-id.
What is the recommended version of OpenVPN to fix this vulnerability on Ubuntu 18.04 LTS?
The recommended version of OpenVPN to fix this vulnerability on Ubuntu 18.04 LTS is 2.4.4-2ubuntu1.5 or later.
Where can I find more information about this OpenVPN vulnerability?
You can find more information about this OpenVPN vulnerability at the following references: [CVE-2020-15078](https://ubuntu.com/security/CVE-2020-15078) and [CVE-2020-11810](https://ubuntu.com/security/CVE-2020-11810).
- agent/severity
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/title
- agent/references
- agent/description
- agent/tags
- agent/event
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/21.04
- version/ubuntu ubuntu/20.10
- version/ubuntu ubuntu/20.04
- version/ubuntu ubuntu/18.04