6186fe732b
Fixes two related security vulnerabilities (CVE-2020-15078) which under very specific circumstances allow tricking a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. In combination with "--auth-gen-token" or a user-specific token auth solution it can be possible to get access to a VPN with an otherwise-invalid account. OpenVPN 2.5.2 also includes other bug fixes and improvements. Add CI build test script. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
11 lines
412 B
Diff
11 lines
412 B
Diff
--- a/src/openvpn/ssl_mbedtls.c
|
|
+++ b/src/openvpn/ssl_mbedtls.c
|
|
@@ -1535,7 +1535,7 @@ const char *
|
|
get_ssl_library_version(void)
|
|
{
|
|
static char mbedtls_version[30];
|
|
- unsigned int pv = mbedtls_version_get_number();
|
|
+ unsigned int pv = MBEDTLS_VERSION_NUMBER;
|
|
sprintf( mbedtls_version, "mbed TLS %d.%d.%d",
|
|
(pv>>24)&0xff, (pv>>16)&0xff, (pv>>8)&0xff );
|
|
return mbedtls_version;
|