CVE-2020-15075: 
NixOS vulnerability analysis and mitigation

OpenVPN Connect installer for macOS version 3.2.6 and older contains a vulnerability (CVE-2020-15075) that could potentially corrupt system critical files through improper handling of symlinks in the /tmp directory. The vulnerability was discovered and reported by OpenVPN Inc., and was fixed in version 3.2.7 released on March 16, 2021 (OpenVPN Changelog).

The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access) and CWE-61 (UNIX Symbolic Link Following). It received a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, indicating local access is required but no user interaction is needed for exploitation (NVD).

The vulnerability could allow an attacker to corrupt system critical files that the installer should not have access to, potentially compromising system integrity and stability (NVD).

The vulnerability was fixed in OpenVPN Connect version 3.2.7 (3220) released on March 16, 2021. Users should upgrade to this version or later to mitigate the vulnerability. The fix specifically addresses the log file symlink creation process during installation (OpenVPN Changelog).