CVE-2020-11810 log
| Source |
|
| Severity | Medium |
| Remote | Yes |
| Type | Denial of service |
| Description | A security issue has been found in OpenVPN before 2.4.9, where a 'peer-id' check is not performed correctly during a small amount of time after a connection has been established. A rogue client sending a data channel packet during that time, from a different source address and with the same 'peer-id', would cause the client data to float to that new address, effectively sopping the VPN traffic of the first, legitimate client. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-1135 | openvpn | 2.4.8-4 | 2.4.9-1 | Medium | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 17 Apr 2020 | ASA-202004-16 | AVG-1135 | openvpn | Medium | denial of service |
| References |
|---|
https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab https://community.openvpn.net/openvpn/ticket/1272 |