Bugzilla – Bug 1215669
VUL-1: CVE-2018-20319: openconnect: information leak
Last modified: 2024-02-13 09:47:33 UTC
CVE-2018-20319: > The OpenConnect VPN client, on all supported platforms, suffered from a possible information leak > that could result in an attacker with elevated local privileges obtaining plaintext credentials. > This VPN security vulnerability has now been patched and assigned CVE-2018-20319. https://github.com/openconnect/openconnect/commit/8b49f8e93e58cc4f4bfa89afc891993524b09acf https://github.com/openconnect/openconnect/commit/db4e72d7376ba32797e47d3690da233ed850d837 https://labs.nettitude.com/blog/why-you-should-always-have-two-factor-authentication-on-your-vpn-cve-2018-20319/
SUSE-SU-2024:0317-1: An update that solves three vulnerabilities, contains two features and has two security fixes can now be installed. Category: security (moderate) Bug References: 1140772, 1157446, 1170452, 1171862, 1215669 CVE References: CVE-2018-20319, CVE-2020-12105, CVE-2020-12823 Jira References: PED-6742, PED-7015 Sources used: openSUSE Leap 15.4 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1 openSUSE Leap 15.5 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1, oath-toolkit-2.6.2-150000.3.5.1 Basesystem Module 15-SP5 (src): oath-toolkit-2.6.2-150000.3.5.1 SUSE Package Hub 15 15-SP5 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1, oath-toolkit-2.6.2-150000.3.5.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1, oath-toolkit-2.6.2-150000.3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.