openvpn.git/debian, branch debian/2.5.1-2 Debian repo for openvpn Changelog for 2.5.1-2 2021-04-28T13:13:12+00:00 Bernhard Schmidt berni@debian.org 2021-04-28T12:42:22+00:00 97fe526142e16e550572991c109f7926cc444cbc 






CVE-2020-15078: Authentication bypass with deferred authentication
2021-04-28T13:12:01+00:00

Bernhard Schmidt
berni@debian.org

2021-04-28T12:38:07+00:00

a398f557fd1320096e140f8ca297481ae75e12b3

Overview

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass
authentication and access control channel data on servers configured
with deferred authentication, which can be used to potentially trigger
further information leaks.

Detailed description

This bug allows - under very specific circumstances - to trick a server
using delayed authentication (plugin or management) into returning a
PUSH_REPLY before the AUTH_FAILED message, which can possibly be used
to gather information about a VPN setup.

In combination with "--auth-gen-token" or a user-specific token auth
solution it can be possible to get access to a VPN with an
otherwise-invalid account.

Pre-Dependency:
CVE-2020-15078-0.patch: https://github.com/OpenVPN/openvpn/commit/14511010

CVE-Fix:
CVE-2020-15078-1.patch: https://github.com/OpenVPN/openvpn/commit/3aca477a
CVE-2020-15078-2.patch: https://github.com/OpenVPN/openvpn/commit/3d18e308
CVE-2020-15078-3.patch: https://github.com/OpenVPN/openvpn/commit/f7b3bf06

Closes: #987380





Overview

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass
authentication and access control channel data on servers configured
with deferred authentication, which can be used to potentially trigger
further information leaks.

Detailed description

This bug allows - under very specific circumstances - to trick a server
using delayed authentication (plugin or management) into returning a
PUSH_REPLY before the AUTH_FAILED message, which can possibly be used
to gather information about a VPN setup.

In combination with "--auth-gen-token" or a user-specific token auth
solution it can be possible to get access to a VPN with an
otherwise-invalid account.

Pre-Dependency:
CVE-2020-15078-0.patch: https://github.com/OpenVPN/openvpn/commit/14511010

CVE-Fix:
CVE-2020-15078-1.patch: https://github.com/OpenVPN/openvpn/commit/3aca477a
CVE-2020-15078-2.patch: https://github.com/OpenVPN/openvpn/commit/3d18e308
CVE-2020-15078-3.patch: https://github.com/OpenVPN/openvpn/commit/f7b3bf06

Closes: #987380







Changelog for 2.5.1-1
2021-02-24T18:54:59+00:00

Bernhard Schmidt
berni@debian.org

2021-02-24T18:54:59+00:00

a8b5c8b8223889ccbb3f415ba206027a4f1b3b67












Changelog for 2.5.0-1
2020-10-28T18:39:28+00:00

Bernhard Schmidt
berni@debian.org

2020-10-28T18:39:28+00:00

76fee93e6fe89e5575bae2840b585d2f025b9050












Changelog for 2.5~rc3-1
2020-10-20T17:18:06+00:00

Bernhard Schmidt
berni@debian.org

2020-10-20T17:18:06+00:00

e366d0b3bf15f6e839f52229d3bd4d8d333cea46












Changelog for 2.5~rc2-1
2020-09-30T19:12:32+00:00

Bernhard Schmidt
berni@debian.org

2020-09-30T19:12:32+00:00

4ca7910f8fbd80a28780cff34d27b481ae882f67












Downgrade debhelper-compat to 12 for easier backports
2020-09-30T19:10:36+00:00

Bernhard Schmidt
berni@debian.org

2020-09-30T19:10:23+00:00

b97ad09a3b8c0017db0a677667a7215f1a98cccf












Changelog for 2.5~beta3-1
2020-09-01T14:55:17+00:00

Bernhard Schmidt
berni@debian.org

2020-09-01T14:55:17+00:00

457cf61d5ab5ff5643e0b9d58a790f3ed2bdcec9












Revert "d/gbp.conf for experimental 2.5 branch"
2020-09-01T14:53:07+00:00

Bernhard Schmidt
berni@debian.org

2020-09-01T14:53:07+00:00

9ce71e1c58a83737b045861173254911fda9a76a

This reverts commit d3986a312f5fbcfd0e78e6b147eef419fb4e5f54.





This reverts commit d3986a312f5fbcfd0e78e6b147eef419fb4e5f54.







Drop reload support from systemd unit files (LP: #1868127)
2020-08-31T23:17:53+00:00

Lucas Kanashiro
lucas.kanashiro@canonical.com

2020-05-26T19:45:10+00:00

69b02b1f7fd609d84ace13ab04697158de2418a9

The current reload implementation (sending a SIGHUP signal to the
process) fails, and the difference between reload and restart is not
clear. Systemd does not require an implementation for reload.





The current reload implementation (sending a SIGHUP signal to the
process) fails, and the difference between reload and restart is not
clear. Systemd does not require an implementation for reload.