by Kastro
Paper/Archive/CVE-2022-0547

CVE-2022-0547

OpenVPN — OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them make…

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.1.891 × 2017.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Affected

ProductAffectedFixed inSource
OpenVPNversion 2.1 until version 2.4.12 and 2.5.6.–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcommunity.openvpn.net/openvpn/wiki/SecurityAnnouncementsrefcommunity.openvpn.net/openvpn/wiki/CVE-2022-0547refopenvpn.net/community-downloadsadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFFadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAEreflists.debian.org/debian-lts-announce/2022/05/msg00002.htmlreflists.debian.org/debian-lts-announce/2025/03/msg00005.html