aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Andree <mandree@FreeBSD.org>2021-04-21 16:56:54 +0000
committerMatthias Andree <mandree@FreeBSD.org>2021-04-21 17:48:54 +0000
commitd1184f27e5473ca66cb58643eefb5eec8f9a8f07 (patch)
treec258bf2c3d77c472071ebdfe2b96049f86679425
parent8b7214f15623cfef66fd30d8d7a7539e44de24e5 (diff)
downloadports-d1184f27e5473ca66cb58643eefb5eec8f9a8f07.tar.gz
ports-d1184f27e5473ca66cb58643eefb5eec8f9a8f07.zip
security/vuxml: add devel/openvpn < 2.5.2 entry
Security: CVE-2020-15078 Security: efb965be-a2c0-11eb-8956-1951a8617e30
-rw-r--r--security/vuxml/vuln.xml36
1 files changed, 36 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index 0c3e4d58c0b1..302670fcd1c1 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -76,6 +76,42 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="efb965be-a2c0-11eb-8956-1951a8617e30">
+ <topic>openvpn -- deferred authentication can be bypassed in specific circumstances</topic>
+ <affects>
+ <package>
+ <name>openvpn</name>
+ <range><lt>2.5.2</lt></range>
+ </package>
+ <package>
+ <name>openvpn-mbedtls</name>
+ <range><lt>2.5.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Gert Döring reports:</p>
+ <blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2020-15078">
+ <p>
+ OpenVPN 2.5.1 and earlier versions allows a remote attackers to
+ bypass authentication and access control channel data on servers
+ configured with deferred authentication, which can be used to
+ potentially trigger further information leaks.
+ </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://community.openvpn.net/openvpn/wiki/CVE-2020-15078</url>
+ <url>https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst#overview-of-changes-in-252</url>
+ <cvename>CVE-2020-15078</cvename>
+ </references>
+ <dates>
+ <discovery>2021-03-02</discovery>
+ <entry>2021-04-21</entry>
+ </dates>
+ </vuln>
+
<vuln vid="cb13a765-a277-11eb-97a0-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>