Man-in-the-Middle Vulnerability in OpenVPN 3 Core Library

CVE-2021-3547

Summary

The OpenVPN 3 Core Library versions 3.6 and 3.6.1 are susceptible to a man-in-the-middle attack that enables an attacker to bypass certificate authentication. This is achieved by presenting an unrelated server certificate that shares the same hostname specified in the 'verify-x509-name' option of the client configuration. This vulnerability poses a significant risk as it undermines the integrity of secure connections.

References