CVE-2022-0547

Description

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.601

Associated Vulnerability

Vulnerability	OS Platform
virtual private network software (USN-5347-1) openvpn_2.4.4-2ubuntu1.7_i386.deb	Linux
virtual private network software (USN-5347-1) openvpn_2.4.4-2ubuntu1.7_amd64.deb	Linux
virtual private network software (USN-5347-1) openvpn_2.5.1-3ubuntu2_amd64.deb	Linux
virtual private network software (USN-5347-1) openvpn_2.4.7-1ubuntu2.20.04.4_amd64.deb	Linux
SUSE-SU-2022:1024-1(SUSE Linux Enterprise Server 12-SP5 ) openvpn-2.3.8-16.29.1.x86_64.rpm	Linux
SUSE-SU-2022:1024-1(SUSE Linux Enterprise Server 12-SP5 ) openvpn-auth-pam-plugin-2.3.8-16.29.1.x86_64.rpm	Linux
SUSE-SU-2022:1024-1(SUSE Linux Enterprise Server 12-SP5 ) openvpn-auth-pam-plugin-debuginfo-2.3.8-16.29.1.x86_64.rpm	Linux
SUSE-SU-2022:1024-1(SUSE Linux Enterprise Server 12-SP5 ) openvpn-debuginfo-2.3.8-16.29.1.x86_64.rpm	Linux
SUSE-SU-2022:1024-1(SUSE Linux Enterprise Server 12-SP5 ) openvpn-debugsource-2.3.8-16.29.1.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234