Description (CNA)
OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / OpenVPN 3 Core Library | affected 3.6 and 3.6.1 |
CWE
CWE-305
References
- https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements
- https://community.openvpn.net/openvpn/wiki/CVE-2021-3547
ADP enrichment
No English description supplied.