PT-2020-19476 · Aviatrix+1 · Aviatrix Openvpn Client+1

Published 2020-04-16 · Updated 2022-07-12 · CVE-2020-7224

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aviatrix OpenVPN client versions through 2.5.7

Description The issue arises when OpenSSL parameters are altered from their issued value set, potentially allowing unauthorized third-party libraries to load. This could lead to unauthorized access.

Recommendations For Aviatrix OpenVPN client versions through 2.5.7, ensure that OpenSSL parameters are not altered from their default settings to prevent potential exploitation. As a temporary workaround, consider restricting modifications to OpenSSL parameters until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-7224

Affected Products

Aviatrix Openvpn Client

Openssl

References · 10

• https://osv.dev/vulnerability/ALPINE-CVE-2020-7224 · Vendor Advisory
• https://docs.aviatrix.com/HowTos/security_bulletin_article.html#article-avxsb-00001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7224 · Security Note
• https://docs.aviatrix.com/#security-bulletin · Vendor Advisory
• https://docs.aviatrix.com/HowTos/security_bulletin_article.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7224 · Vendor Advisory
• https://t.me/cvenotify/5737 · Telegram Post
• https://t.me/cvenotify/2851 · Telegram Post
• https://security.alpinelinux.org/vuln/CVE-2020-7224 · Note
• https://t.me/cvenotify/4030 · Telegram Post