SB2024092206 - Gentoo update for OpenVPN
Published: September 22, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper Authentication (CVE-ID: CVE-2022-0547)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests in external authentication plug-ins when more than one of them makes use of deferred authentication replies. A remote attacker can bypass authentication process and gain unauthorized access to the network with only partially correct credentials.
2) Division by zero (CVE-ID: CVE-2023-46849)
The vulnerability allows a remote client to perform a denial of service (DoS) attack.
The vulnerability exists due to server incorrectly restores "--fragment" configuration under certain circumstances. A remote client can cause a divide by zero error and perform a denial of service (DoS) attack.
3) Use-after-free (CVE-ID: CVE-2023-46850)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to openvpn incorrectly uses a send buffer after it has been freed. Under certain circumstances the freed memory can be sent to the client peer, resulting in information disclosure. The vulnerability affects TLS configuration.
Remediation
Install update from vendor's website.