CVE-2020-5180: 
Viscosity vulnerability analysis and mitigation

Viscosity 1.8.2 on Windows and macOS contains a low-severity security vulnerability (CVE-2020-5180) that allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious OpenSSL engine and associated command (SparkLabs Blog, NVD).

The vulnerability allows an attacker with local access to potentially run arbitrary code within Viscosity's OpenVPN sandbox by using a maliciously crafted OpenSSL engine and associated command. The attack is contained within Viscosity's sandbox, which has de-elevated permissions and access restrictions (SparkLabs Blog).

Under macOS, an attacker may be able to access on-disk VPN credentials (such as a certificate and private key) from other active OpenVPN connections that run within the sandbox at the same time. This issue does not affect the Windows version. The attacker does not gain elevated local permissions (such as root or SYSTEM) on the machine and their actions are severely limited (SparkLabs Blog).

The vulnerability requires local access to the system to exploit. The attack is specifically concerning in multi-user macOS environments where multiple users have access to the same system (SparkLabs Blog).

The vulnerability was fixed in Viscosity version 1.8.4 for both macOS and Windows. Users are encouraged to update to this version as soon as possible, particularly those in multi-user macOS environments (SparkLabs Blog).

The vulnerability was discovered and reported by security researcher Rich Mirch. SparkLabs, the developer of Viscosity, classified this as a low-severity security vulnerability (SparkLabs Blog).