Bug 1215669 (CVE-2018-20319) - VUL-1: CVE-2018-20319: openconnect: information leak
Summary: VUL-1: CVE-2018-20319: openconnect: information leak
Status: IN_PROGRESS
Alias: CVE-2018-20319
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: E-mail List
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/379745/
Whiteboard: CVSSv3.1:SUSE:CVE-2018-20319:2.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-25 12:04 UTC by Robert Frohl
Modified: 2024-02-13 09:47 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2023-09-25 12:04:40 UTC
CVE-2018-20319:

> The OpenConnect VPN client, on all supported platforms, suffered from a possible information leak
> that could result in an attacker with elevated local privileges obtaining plaintext credentials. 
> This VPN security vulnerability has now been patched and assigned CVE-2018-20319.

https://github.com/openconnect/openconnect/commit/8b49f8e93e58cc4f4bfa89afc891993524b09acf
https://github.com/openconnect/openconnect/commit/db4e72d7376ba32797e47d3690da233ed850d837
https://labs.nettitude.com/blog/why-you-should-always-have-two-factor-authentication-on-your-vpn-cve-2018-20319/
Comment 5 Maintenance Automation 2024-02-02 12:30:07 UTC
SUSE-SU-2024:0317-1: An update that solves three vulnerabilities, contains two features and has two security fixes can now be installed.

Category: security (moderate)
Bug References: 1140772, 1157446, 1170452, 1171862, 1215669
CVE References: CVE-2018-20319, CVE-2020-12105, CVE-2020-12823
Jira References: PED-6742, PED-7015
Sources used:
openSUSE Leap 15.4 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1
openSUSE Leap 15.5 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1, oath-toolkit-2.6.2-150000.3.5.1
Basesystem Module 15-SP5 (src): oath-toolkit-2.6.2-150000.3.5.1
SUSE Package Hub 15 15-SP5 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1, oath-toolkit-2.6.2-150000.3.5.1
SUSE Linux Enterprise Workstation Extension 15 SP5 (src): stoken-0.81-150400.13.2.1, openconnect-9.12-150400.15.3.1, oath-toolkit-2.6.2-150000.3.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.