PT-2023-6378 · Openvpn · Openvpn Connect

Mr. Ka Lok Wu · Published 2023-10-17 · Updated 2023-10-24 · CVE-2022-3761

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenVPN Connect versions before 3.4.0.4506 (macOS) OpenVPN Connect versions before 3.4.0.3100 (Windows)

Description The issue is related to errors in the certificate authentication procedure, allowing a remote attacker to perform a man-in-the-middle attack. This can lead to the interception of configuration profile download requests, which may contain user credentials.

Recommendations For OpenVPN Connect versions before 3.4.0.4506 (macOS), update to version 3.4.0.4506 or later. For OpenVPN Connect versions before 3.4.0.3100 (Windows), update to version 3.4.0.3100 or later. As a temporary workaround, consider restricting access to sensitive configuration profiles until a patch is applied.

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

BDU:2023-07090

CVE-2022-3761

Affected Products

Openvpn Connect

References · 8

• https://bdu.fstec.ru/vul/2023-07090 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3761 · Security Note
• https://t.me/cibsecurity/72420 · Telegram Post
• https://twitter.com/CVEnew/status/1714257453590974674 · Twitter Post
• https://twitter.com/DMFezzaReedCISA/status/1714284059306901858 · Twitter Post
• https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log · Note
• https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log · Note