From 87c8c081d5a1ede46b3cb01e0c25a876441f074b Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Thu, 24 Jun 2021 15:08:40 +0200 Subject: [PATCH] Ensure tls session is authenticated before sending push reply We ensure here that the tls session is authenticated before sending a push_reply This the final part of the fix for CVE-2020-15078 in the master branch. CVE: 2020-15078 Acked-by: Gert Doering Message-Id: <20210624130840.2583433-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22587.html Signed-off-by: Gert Doering --- src/openvpn/push.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/openvpn/push.c b/src/openvpn/push.c index f3a0054a9..f4957f147 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -867,7 +867,8 @@ process_incoming_push_request(struct context *c) send_auth_failed(c, client_reason); ret = PUSH_MSG_AUTH_FAILURE; } - else if (c->c2.tls_multi->multi_state >= CAS_CONNECT_DONE) + else if (tls_authentication_status(c->c2.tls_multi) == TLS_AUTHENTICATION_SUCCEEDED + && c->c2.tls_multi->multi_state >= CAS_CONNECT_DONE) { time_t now; -- 2.47.2