Bug 835514 – <net-vpn/openvpn-2.5.6: potential authentication by-pass with multiple deferred authentication plug-ins

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2022-03-17 18:23:41 UTC]

From URL, "OpenVPN 2.1 up to v2.4.11 and v2.5.5 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

This issue is resolved in OpenVPN 2.4.12 and v2.5.6 where the OpenVPN server process will stop running with the following error message in the logs:

Exiting due to multiple authentication plug-ins performing deferred authentication.  Only one authentication plug-in doing deferred auth is allowed.  Ignoring the result and stopping now, the current authentication result is not to be trusted."

Please bump to 2.5.6.

[Comment 1 Larry the Git Cow 2022-04-23 01:34:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d85036d80926637fb9170e9a02ca9c6f3f35086b

commit d85036d80926637fb9170e9a02ca9c6f3f35086b
Author:     Tomáš Mózes <[e-mail]>
AuthorDate: 2022-04-19 22:41:00 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-04-23 01:22:45 +0000

    net-vpn/openvpn: bump to 2.5.6
    
    Bug: https://bugs.gentoo.org/835514
    Closes: https://bugs.gentoo.org/818436
    Signed-off-by: Tomáš Mózes <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/25120
    Signed-off-by: Sam James <[e-mail]>

 net-vpn/openvpn/Manifest             |   1 +
 net-vpn/openvpn/openvpn-2.5.6.ebuild | 197 +++++++++++++++++++++++++++++++++++
 2 files changed, 198 insertions(+)

[Comment 2 Sam James 2022-04-23 02:00:31 UTC]

Please stable when ready.

[Comment 3 John Helmert III 2022-06-06 15:51:36 UTC]

Please cleanup

[Comment 4 Larry the Git Cow 2024-09-22 06:35:02 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=fe4473d49e5050fff69ba9135163bb00b7c70710

commit fe4473d49e5050fff69ba9135163bb00b7c70710
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-09-22 06:34:37 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-09-22 06:35:01 +0000

    [ GLSA 202409-08 ] OpenVPN: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/835514
    Bug: https://bugs.gentoo.org/917272
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202409-08.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)