CVE-2020-11810
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-11810
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-11810.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-11810
- Related
- Published
- 2020-04-27T15:15:12Z
- Modified
- 2024-10-12T05:42:03.409483Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (PDATAV2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use.
- References
-
- https://community.openvpn.net/openvpn/ticket/1272
- https://patchwork.openvpn.net/patch/1079/
- https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
- https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab
- https://bugzilla.suse.com/show_bug.cgi?id=1169925
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/
- https://security-tracker.debian.org/tracker/CVE-2020-11810
- https://security.alpinelinux.org/vuln/CVE-2020-11810
Affected packages
Alpine:v3.10 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
Alpine:v3.11 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
Alpine:v3.12 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.13 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.14 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.15 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.16 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.17 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.18 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.19 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Alpine:v3.20 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:apk/alpine/openvpn?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.4.9-r0
Affected versions
2.*
2.0.9-r0
2.0.9-r1
2.0.9-r2
2.1.1-r0
2.1.1-r1
2.1.1-r2
2.1.3-r0
2.1.4-r0
2.1.4-r1
2.2.0-r0
2.2.0-r1
2.2.0-r2
2.2.2-r0
2.3.0-r0
2.3.1-r0
2.3.2-r0
2.3.2-r1
2.3.2-r2
2.3.3-r0
2.3.4-r0
2.3.5-r0
2.3.6-r0
2.3.6-r1
2.3.7-r0
2.3.8-r0
2.3.8-r1
2.3.9-r0
2.3.10-r0
2.3.10-r1
2.3.10-r2
2.3.11-r0
2.3.12-r0
2.3.12-r1
2.3.14-r0
2.4.0-r0
2.4.1-r0
2.4.1-r1
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.4-r1
2.4.5-r0
2.4.5-r1
2.4.6-r0
2.4.6-r1
2.4.6-r2
2.4.6-r3
2.4.6-r4
2.4.6-r5
2.4.7-r0
2.4.7-r1
2.4.8-r0
2.4.8-r1
2.4.8-r2
2.4.8-r3
2.4.8-r4
Debian:11 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:deb/debian/openvpn?arch=source
Debian:12 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:deb/debian/openvpn?arch=source
Debian:13 / openvpn
Package
- Name
- openvpn
- Purl
- pkg:deb/debian/openvpn?arch=source
Git / github.com/openvpn/openvpn
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openvpn/openvpn
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v2.*
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1_rc1
v2.1_rc10
v2.1_rc11
v2.1_rc12
v2.1_rc13
v2.1_rc14
v2.1_rc15
v2.1_rc16
v2.1_rc17
v2.1_rc18
v2.1_rc19
v2.1_rc2
v2.1_rc20
v2.1_rc21
v2.1_rc22
v2.1_rc3
v2.1_rc4
v2.1_rc5
v2.1_rc6
v2.1_rc7
v2.1_rc8
v2.1_rc9
v2.2-RC
v2.2-RC2
v2.2-beta4
v2.2-beta5
v2.3-alpha1
v2.3_alpha2
v2.3_alpha3
v2.3_beta1
v2.4_alpha1
v2.4_alpha2
v2.4_beta1
v2.4_beta2
v2.4_rc1
v2.4_rc2