OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openvpn | Openvpn | * | 2.4.11 (excluding) |
| Openvpn | Openvpn | 2.5.0 (including) | 2.5.2 (excluding) |
| Openvpn | Ubuntu | bionic | * |
| Openvpn | Ubuntu | devel | * |
| Openvpn | Ubuntu | focal | * |
| Openvpn | Ubuntu | groovy | * |
| Openvpn | Ubuntu | hirsute | * |
| Openvpn | Ubuntu | impish | * |
| Openvpn | Ubuntu | jammy | * |
| Openvpn | Ubuntu | trusty | * |
| Openvpn | Ubuntu | upstream | * |