CVE-2022-0547: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 34 only; version 36 only
• Openvpn Openvpn: from 2.1.0, before 2.4.12 (fixed in 2.4.12); from 2.5.0, before 2.5.6 (fixed in 2.5.6)

Published 2022-03-18. Last modified 2026-06-17.