CVE catalog

CVE-2020-11810

openvpn affected and fixed versions

[CVE catalog]

An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use.

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.65% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securityopenvpn2.6.14-1+deb13u3Fixed[CVE-2020-11810]
Debiantrixieopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debiantrixieopenvpn2.6.14-1+deb13u3Fixed[CVE-2020-11810]
Debiansidopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debiansidopenvpn2.7.8-1Fixed[CVE-2020-11810]
Debianforkyopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debianforkyopenvpn2.7.8-1Fixed[CVE-2020-11810]
Debianbookworm-securityopenvpn2.6.14-0+deb12u2Fixed[CVE-2020-11810]
Debianbookwormopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debianbookwormopenvpn2.6.14-0+deb12u2Fixed[CVE-2020-11810]

Showing 10 fix observations. All 35 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedopenvpn2.4.9-1UnknownSource applicability is not establishedProvider not reported
Alpine3.10openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.11openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.12openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.13openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.14openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.15openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.16openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.17openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.18openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.19openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.20openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.21openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.22openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.23openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Alpine3.24openvpn2.4.9-r0UnknownSource applicability is not established[ALPINE-CVE-2020-11810]
Debianbookwormopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debianbookwormopenvpn2.6.14-0+deb12u2Fixed[CVE-2020-11810]
Debianbookworm-securityopenvpn2.6.14-0+deb12u2Fixed[CVE-2020-11810]
Debianforkyopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debianforkyopenvpn2.7.8-1Fixed[CVE-2020-11810]
Debiansidopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debiansidopenvpn2.7.8-1Fixed[CVE-2020-11810]
Debiantrixieopenvpn2.4.9-1FixedDistribution-reported fixed boundary[CVE-2020-11810]
Debiantrixieopenvpn2.6.14-1+deb13u3Fixed[CVE-2020-11810]
Debiantrixie-securityopenvpn2.6.14-1+deb13u3Fixed[CVE-2020-11810]
Ubuntu18.04openvpn2.4.3-4ubuntu1UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu18.04openvpn2.4.4-1ubuntu1UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu18.04openvpn2.4.4-2ubuntu1UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu18.04openvpn2.4.4-2ubuntu1.1UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu18.04openvpn2.4.4-2ubuntu1.2UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu18.04openvpn2.4.4-2ubuntu1.3UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu18.04openvpn2.4.4-2ubuntu1.5UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu20.04openvpn2.4.7-1ubuntu2UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Ubuntu20.04openvpn2.4.7-1ubuntu2.20.04.2UnknownSource applicability is not established[USN-4933-1][UBUNTU-CVE-2020-11810]
Original provider fields
{
  "package_releases": [
    {
      "name": "openvpn",
      "status": "fixed",
      "release": "sid",
      "version": "2.7.8-1"
    },
    {
      "name": "openvpn",
      "status": "fixed",
      "release": "forky",
      "version": "2.7.8-1"
    },
    {
      "name": "openvpn",
      "status": "fixed",
      "release": "trixie",
      "version": "2.6.14-1+deb13u3"
    },
    {
      "name": "openvpn",
      "status": "fixed",
      "release": "trixie-security",
      "version": "2.6.14-1+deb13u3"
    },
    {
      "name": "openvpn",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.6.14-0+deb12u2"
    },
    {
      "name": "openvpn",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "2.6.14-0+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "openvpn",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "low",
      "fixed_version": "2.4.9-1"
    },
    {
      "bug": null,
      "name": "openvpn",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "low",
      "fixed_version": "2.4.9-1"
    },
    {
      "bug": null,
      "name": "openvpn",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "low",
      "fixed_version": "2.4.9-1"
    },
    {
      "bug": null,
      "name": "openvpn",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "low",
      "fixed_version": "2.4.9-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "openvpn",
      "fixed_version": "2.4.9-1",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.10",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.11",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.12",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.13",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.14",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.15",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.16",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.17",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.18",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.19",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.20",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.21",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.22",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.9-r0"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-11810",
      "fixed_version": "2.4.9-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-11810",
      "provider_updated_at": "2026-10-26T11:17:55.101219665Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.4-2ubuntu1.5"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.4.3-4ubuntu1",
        "2.4.4-1ubuntu1",
        "2.4.4-2ubuntu1",
        "2.4.4-2ubuntu1.1",
        "2.4.4-2ubuntu1.2",
        "2.4.4-2ubuntu1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4933-1",
      "fixed_version": "2.4.4-2ubuntu1.5",
      "provider_source": "pypi",
      "provider_record_id": "USN-4933-1",
      "provider_updated_at": "2026-02-10T04:42:09Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.7-1ubuntu2.20.04.2"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.4.7-1ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4933-1",
      "fixed_version": "2.4.7-1ubuntu2.20.04.2",
      "provider_source": "pypi",
      "provider_record_id": "USN-4933-1",
      "provider_updated_at": "2026-02-10T04:42:09Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.4-2ubuntu1.5"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.4.3-4ubuntu1",
        "2.4.4-1ubuntu1",
        "2.4.4-2ubuntu1",
        "2.4.4-2ubuntu1.1",
        "2.4.4-2ubuntu1.2",
        "2.4.4-2ubuntu1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-11810",
      "fixed_version": "2.4.4-2ubuntu1.5",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-11810",
      "provider_updated_at": "2026-02-04T03:07:36.910087Z",
      "applicability_unknown": true
    },
    {
      "name": "openvpn",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.7-1ubuntu2.20.04.2"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.4.7-1ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-11810",
      "fixed_version": "2.4.7-1ubuntu2.20.04.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-11810",
      "provider_updated_at": "2026-02-04T03:07:36.910087Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [openvpn]Unknown
    Details (4)

    • 2.6.14-0+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

    • 2.6.14-0+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

    • 2.6.14-0+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

    • 2.6.14-0+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12

[Debian 13 (Trixie)]

  • [openvpn]Unknown
    Details (6)

    • 2.6.14-1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · 13

    • 2.6.14-1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · 13

    • 2.7.5-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · 13

    • 2.7.5-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · 13

    • 2.6.14-1+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · 13

    • 2.6.14-1+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 2.4.9-1

      dsa · openvpn · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]