Impact: None.
Details:
OpenVPN Access Server uses OpenVPN for VPN connections. OpenVPN versions 2.7_alpha1 through 2.7.7 are vulnerable to improper name matching in the verify-x509-name option. An attacker could exploit this vulnerability by using a specially crafted X.509 certificate subject containing special characters to impersonate another user. However, exploitation requires the certificate to be signed by a trusted certificate authority (CA).
Access Server doesn't use the verify-x509-name option on either the server or client side. Instead, Access Server uses remote-tls server and remote-tls client, which aren't affected by this vulnerability. Access Server also identifies client certificates by their serial numbers in its database rather than relying on subject name matching. Additionally, the internal CA doesn't generate certificates that could trigger this vulnerability.
Remediation:
No action is required.
Need help?
If you have questions, submit a support ticket.
Comments
0 comments
Article is closed for comments.