Stay Secure with the Latest Linux Advisories

security advisorysecurity issueOpenVPN

Mageia: 2020-0195 Critical: OpenVPN Data Channel Vulnerability

Updated openvpn packages fix security vulnerability: An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the . MGASA-2020-0195 - Updated openvpn packages fix security vulnerability Publication date: 05 May 2020 URL: https://advisories.mageia.org/MGASA-2020-0195.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-11810 Updated openvpn packages fix security vulnerability: An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use (CVE-2020-11810). The openvpn package has been updated to version 2.4.9, fixing the issue and other bugs. See the upstream release notes for details. References: - https://bugs.mageia.org/show_bug.cgi?id=26558 - https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/F6UXS4WUVAGMXRRBWQNUHMT5JZYYW4KW/ - https://www.cve.org/CVERecord?id=CVE-2020-11810 SRPMS: - 7/core/openvpn-2.4.9-1.mga7 . Mageia 2020-0196 tackles a significant OpenSSH flaw, enhancing protection and thwarting unauthorized access attempts.. OpenVPN Security Update, Mageia Security Advisory, Data Channel Vulnerability. . Severity: Critical. LinuxSecurity.com Team

May 05, 2020 •Critical Mageia