Description
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | OpenVPN | 2.5.1 and earlier versions | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openvpn | 2.5.1-2 | — |
| Debian 13 | openvpn | 2.5.1-2 | — |
| Debian 12 | openvpn | 2.5.1-2 | — |
| Debian 9 | openvpn | 2.4.0-6+deb9u4 | DLA-2992-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | openvpn | 2.4.7-1ubuntu2.20.04.2 | USN-4933-1 |
| Ubuntu 18.04 LTS | openvpn | 2.4.4-2ubuntu1.5 | USN-4933-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | openvpn | 2.4.3-5.7.1 | SUSE-SU-2021:1577-1 |
| SLES 15 SP2 | openvpn | 2.4.3-5.7.1 | SUSE-SU-2021:1577-1 |
| SLES 12 SP5 | openvpn | 2.3.8-16.26.1 | SUSE-SU-2021:1576-1 |
| SLES 11 | openvpn-openssl1 | 2.3.2-0.10.9.1 | SUSE-SU-2021:14723-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | openvpn | 2.3.8-16.26.1 | SUSE-SU-2021:1576-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openvpn | 2.5.3-1.2 | openSUSE-SU-2024:11128-1 |
| openSUSE Leap 15.2 | openvpn | 2.4.3-lp152.6.3.1 | openSUSE-SU-2021:0734-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openvpn | 2.5.2-r0 | — |
| Alpine v3.23 | openvpn | 2.5.2-r0 | — |
| Alpine v3.22 | openvpn | 2.5.2-r0 | — |
| Alpine v3.21 | openvpn | 2.5.2-r0 | — |
| Alpine v3.20 | openvpn | 2.5.2-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openvpn | 2.5.2-r0 | — |
| Alpine v3.18 | openvpn | 2.5.2-r0 | — |
| Alpine v3.17 | openvpn | 2.5.2-r0 | — |
| Alpine v3.16 | openvpn | 2.5.2-r0 | — |
| Alpine v3.15 | openvpn | 2.5.2-r0 | — |
| Alpine v3.14 | openvpn | 2.5.2-r0 | — |
| Alpine v3.13 | openvpn | 2.5.2-r0 | — |
| Alpine v3.12 | openvpn | 2.4.11-r0 | — |
| Alpine v3.11 | openvpn | 2.4.11-r0 | — |
| Alpine v3.10 | openvpn | 2.4.11-r0 | — |
Advisories 8
- DLA-2992-1 openvpn - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4933-1 openvpn vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2021:14723-1 Security update for openvpn-openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11128-1 openvpn-2.5.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0734-1 Security update for openvpn SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1576-1 Security update for openvpn SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1577-1 Security update for openvpn SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2022-010 PHOENIX CONTACT: Multiple Linux component vulnerabilities fixed in latest AXC F x152 LTS release CERT@VDE · May 22, 2025
References
- FEDORA-2021-242ef81244 vendor-advisory
- FEDORA-2021-b805c26afa vendor-advisory
- https://community.openvpn.net/openvpn/wiki/CVE-2020-15078
- https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements
- FEDORA-2021-d6b9d8497b vendor-advisory
- GLSA-202105-25 vendor-advisory
- https://usn.ubuntu.com/usn/usn-4933-1 vendor-advisory
- [debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update mailing-list