Bug 1186876 (CVE-2020-36382)

Summary: VUL-1: CVE-2020-36382: openvpn: OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger a a denial of service during the user authentication phase
Product: [Novell Products] SUSE Security Incidents Reporter: Gianluca Gabrielli <gianluca.gabrielli>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED DUPLICATE QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P5 - None CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/301264/
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Gianluca Gabrielli 2021-06-04 15:35:01 UTC
OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an
assert during the user authentication phase via incorrect authentication token
data in an early phase of the user authentication resulting in a denial of

Comment 1 Gianluca Gabrielli 2021-06-04 15:35:22 UTC
This only affect the closed source version of OpenVPN (OpenVPN Access Server). The same vulnerability has been addressed in the open source OpenVPN codebase as CVE-2020-15078 (bsc#1185279).

*** This bug has been marked as a duplicate of bug 1185279 ***