CVE-2022-0547

Summary

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Affected Software

Weaknesses

• CWE-305: CWE-305 - Authentication Bypass by Primary Weakness

ADP Enrichment

CVE Program Container

Additional References

• https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements
• https://community.openvpn.net/openvpn/wiki/CVE-2022-0547
• https://openvpn.net/community-downloads/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/
• https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
• https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements
• https://community.openvpn.net/openvpn/wiki/CVE-2022-0547
• https://openvpn.net/community-downloads/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/
• https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html

• ←Previous
• Next→