Bug 1804847 (CVE-2020-8953)

Summary:	CVE-2020-8953 openvpn: LDAP authentication bypass
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	dazo, huzaifas, klember, steve
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 05:24:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Guilherme de Almeida Suckevicz 2020-02-19 18:19:01 UTC

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication).

Reference:
https://openvpn.net/security-advisories/

Comment 1 David Sommerseth 2020-02-19 19:12:03 UTC

This is NOT related to the community releases of OpenVPN.  This is related to the Access Server where the LDAP integration implemented, which is a component which is not open sourced.  The Access Server just builds on the OpenVPN community release under the hood for the core VPN functionality.  The management layer (where the LDAP authentication happens in this case) is what makes it the Access Server product; this management layer utilizes the management interface found in the core OpenVPN 2.x component.

From a Fedora and Red Hat products perspective, this ticket can be closed as not applicable.