OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
| Software | From | Fixed in |
|---|---|---|
| debian / debian_linux | 9.0 | 9.0.x |
| fedoraproject / fedora | 32 | 32.x |
| fedoraproject / fedora | 33 | 33.x |
| fedoraproject / fedora | 34 | 34.x |
| canonical / ubuntu_linux | 18.04 | 18.04.x |
| canonical / ubuntu_linux | 20.04 | 20.04.x |
| canonical / ubuntu_linux | 20.10 | 20.10.x |
| canonical / ubuntu_linux | 21.04 | 21.04.x |
| openvpn / openvpn | - | 2.4.11 |
| openvpn / openvpn | 2.5.0 | 2.5.2 |