CVE-2005-2531

OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails…

published August 24, 2005

CVSS
—
EPSS
2%
Percentile
80.2
In the wild
Unconfirmed
What it is

OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01966 · 80.2th percentile
Published
2005-08-24T04:00Z
EPSS history
Timeline
  • 24 AUG 04:00Z
    OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails…
    cvelistv5