Log in Start free

Vulnerability · Published Apr 26, 2021 · Assigned by OpenVPN

CVE-2020-15078

High 7.5

In plain English

A high-severity security flaw in OpenVPN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.9% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.9%top 7.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20openvpn2.5.2-r0ALPINE-CVE-2020-15078
Alpine:v3.21openvpn2.5.2-r0ALPINE-CVE-2020-15078
Alpine:v3.22openvpn2.5.2-r0ALPINE-CVE-2020-15078
Alpine:v3.23openvpn2.5.2-r0ALPINE-CVE-2020-15078
Alpine:v3.24openvpn2.5.2-r0ALPINE-CVE-2020-15078
Debian:12openvpn2.5.1-2DEBIAN-CVE-2020-15078
Debian:13openvpn2.5.1-2DEBIAN-CVE-2020-15078
Debian:14openvpn2.5.1-2DEBIAN-CVE-2020-15078

Affected products (as reported)

VendorProductVersions
n/a OpenVPN 2.5.1 and earlier versions

Weakness: CWE-305

References