CVE-2019-14899 hijacking VPN connections

Question

Hi, 
 Is it known to what extent Sophos products are affected by the vulnerability? 
 
 https://www.terabitweb.com/2019/12/06/cve-2019-14899-vpn-flaw-html/

KingChris · Accepted Answer

Hi ThorstenSult 
 I have received feedback from the development team. 
 They have stated that the XG is not affected by this vulnerability as per analysis of this CVE shows that affects route based VPNs. As the XGs VPN capabilities are only policy based, this should not affect the XG even if the XG acts as a client in the SSL VPN site-to-site configuration. 
 There will be a KB article written up to reflect this same information. 
 Thanks!

KingChris · Answer

Hi Community, 
 Herewith is the KB article that addresses any concerns surrounding this CVE number. 
 https://www.sophos.com/kb/134996 
 Thanks!