Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 835514 (CVE-2022-0547) - <net-vpn/openvpn-2.5.6: potential authentication by-pass with multiple deferred authentication plug-ins
Summary: <net-vpn/openvpn-2.5.6: potential authentication by-pass with multiple deferr...
Alias: CVE-2022-0547
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor with 1 vote (vote)
Assignee: Gentoo Security
Whiteboard: B4 [glsa? cleanup]
Keywords: PullRequest
Depends on: 818436 848969
  Show dependency tree
Reported: 2022-03-17 18:23 UTC by John Helmert III
Modified: 2022-06-06 15:51 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-17 18:23:41 UTC
From URL, "OpenVPN 2.1 up to v2.4.11 and v2.5.5 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

This issue is resolved in OpenVPN 2.4.12 and v2.5.6 where the OpenVPN server process will stop running with the following error message in the logs:

Exiting due to multiple authentication plug-ins performing deferred authentication.  Only one authentication plug-in doing deferred auth is allowed.  Ignoring the result and stopping now, the current authentication result is not to be trusted."

Please bump to 2.5.6.
Comment 1 Larry the Git Cow gentoo-dev 2022-04-23 01:34:25 UTC
The bug has been referenced in the following commit(s):

commit d85036d80926637fb9170e9a02ca9c6f3f35086b
Author:     Tomáš Mózes <>
AuthorDate: 2022-04-19 22:41:00 +0000
Commit:     Sam James <>
CommitDate: 2022-04-23 01:22:45 +0000

    net-vpn/openvpn: bump to 2.5.6
    Signed-off-by: Tomáš Mózes <>
    Signed-off-by: Sam James <>

 net-vpn/openvpn/Manifest             |   1 +
 net-vpn/openvpn/openvpn-2.5.6.ebuild | 197 +++++++++++++++++++++++++++++++++++
 2 files changed, 198 insertions(+)
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-04-23 02:00:31 UTC
Please stable when ready.
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-06-06 15:51:36 UTC
Please cleanup