Low severity3.7NVD Advisory· Published Apr 27, 2020· Updated Jun 17, 2026
CVE-2020-11810
CVE-2020-11810
Description
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- OpenVPN/OpenVPNdescription
- osv-coords4 versionspkg:rpm/opensuse/openvpn&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/openvpn&distro=openSUSE%20Tumbleweedpkg:rpm/suse/openvpn&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/openvpn&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3
< 2.4.3-lp152.6.3.1+ 3 more
- (no CPE)range: < 2.4.3-lp152.6.3.1
- (no CPE)range: < 2.5.3-1.2
- (no CPE)range: < 2.4.3-5.7.1
- (no CPE)range: < 2.4.3-5.7.1
Patches
Vulnerability mechanics
References
8- github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225abnvdPatchThird Party Advisory
- patchwork.openvpn.net/patch/1079/nvdPatchVendor Advisory
- community.openvpn.net/openvpn/ticket/1272nvdExploitVendor Advisory
- bugzilla.suse.com/show_bug.cginvdIssue TrackingThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/05/msg00002.htmlnvdMailing ListThird Party Advisory
- security-tracker.debian.org/tracker/CVE-2020-11810nvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/nvd
News mentions
0No linked articles in our index yet.