Description
OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openconnect | 3.02-1 | — |
| Debian 13 | openconnect | 3.02-1 | — |
| Debian 12 | openconnect | 3.02-1 | — |
References
- FEDORA-2010-18053 vendor-advisory
- FEDORA-2010-18055 vendor-advisory
- FEDORA-2010-18032 vendor-advisory
- ADV-2010-3078 vdb-entry
- 44111 vdb-entry
- http://www.infradead.org/openconnect.html
- 42381 third-party-advisory