Ubuntu 20.04 LTS USN-4933-1 High: OpenVPN Authentication Bypass Detail

ubuntu

May 4, 2021

everal security issues were fixed in OpenVPN.

Summary

everal security issues were fixed in OpenVPN.

Software Description:

- openvpn: virtual private network software

Details:

It was discovered that OpenVPN incorrectly handled certain data channel v2

packets. A remote attacker could possibly use this issue to inject packets

using a victim's peer-id. This issue only affected Ubuntu 18.04 LTS and

Ubuntu 20.04 LTS. (CVE-2020-11810)

It was discovered that OpenVPN incorrectly handled deferred authentication.

When a server is configured to use deferred authentication, a remote

attacker could possibly use this issue to bypass authentication and access

control channel data. (CVE-2020-15078)

Topics Covered

security advisory remote access authentication issue high ubuntu authentication bypass openvpn security notice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.04:
  openvpn                         2.5.1-1ubuntu1.1

Ubuntu 20.10:
  openvpn                         2.4.9-3ubuntu1.1

Ubuntu 20.04 LTS:
  openvpn                         2.4.7-1ubuntu2.20.04.2

Ubuntu 18.04 LTS:
  openvpn                         2.4.4-2ubuntu1.5

In general, a standard system update will make all the necessary changes.