CVE-2022-0547

Summary

CVE	CVE-2022-0547
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-03-18 18:15:00 UTC
Updated	2023-11-07 03:41:00 UTC
Description	OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Risk And Classification

Problem Types: CWE-287

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Fedoraproject	Fedora	34	All	All	All
Operating System	Fedoraproject	Fedora	36	All	All	All
Application	Openvpn	Openvpn	All	All	All	All

References

Reference	Source	Link	Tags
Just a moment...	MISC	community.openvpn.net
Just a moment...	MISC	community.openvpn.net
[SECURITY] Fedora 36 Update: openvpn-2.5.6-1.fc36 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 34 Update: openvpn-2.5.6-1.fc34 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 34 Update: openvpn-2.5.6-1.fc34 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Community Downloads \| OpenVPN	MISC	openvpn.net
[SECURITY] [DLA 2992-1] openvpn security update	MLIST	lists.debian.org
[SECURITY] Fedora 36 Update: openvpn-2.5.6-1.fc36 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

179259 Debian Security Update for Open Virtual Private Network (OpenVPN) (DLA 2992-1)
183852 Debian Security Update for Open Virtual Private Network (OpenVPN) (CVE-2022-0547)
198713 Ubuntu Security Notification for Open Virtual Private Network (OpenVPN) Vulnerability (USN-5347-1)
282483 Fedora Security Update for Open Virtual Private Network (OpenVPN) (FEDORA-2022-a9bd17092d)
282519 Fedora Security Update for Open Virtual Private Network (OpenVPN) (FEDORA-2022-7d46acce7c)
354864 Amazon Linux Security Advisory for Open Virtual Private Network (OpenVPN) : ALAS-2023-1719
355075 Amazon Linux Security Advisory for Open Virtual Private Network (OpenVPN) : AL2012-2023-399
500502 Alpine Linux Security Update for Open Virtual Private Network (OpenVPN)
500570 Alpine Linux Security Update for Open Virtual Private Network (OpenVPN)
500769 Alpine Linux Security Update for openvpn
501169 Alpine Linux Security Update for openvpn
501467 Alpine Linux Security Update for Open Virtual Private Network (OpenVPN)
504263 Alpine Linux Security Update for openvpn
690817 Free Berkeley Software Distribution (FreeBSD) Security Update for Open Virtual Private Network (OpenVPN) (45a72180-a640-11ec-a08b-85298243e224)
751935 SUSE Enterprise Linux Security Update for Open Virtual Private Network (OpenVPN) (SUSE-SU-2022:1029-1)
751938 SUSE Enterprise Linux Security Update for Open Virtual Private Network (OpenVPN) (SUSE-SU-2022:1024-1)
751941 OpenSUSE Security Update for Open Virtual Private Network (OpenVPN) (openSUSE-SU-2022:1029-1)
752208 SUSE Enterprise Linux Security Update for Open Virtual Private Network (OpenVPN) (SUSE-SU-2022:1934-1)