CVE-2024-28820

2024-06-2700:00:00

mitre

www.cve.org

buffer overflow

openvpn-cr.c

openvpn-auth-ldap

three rings auth-ldap plugin

ldap username

buffer overflow

0.0004 Low

EPSS

Percentile

9.1%

JSON

Buffer overflow in the extract_openvpn_cr function in openvpn-cr.c in openvpn-auth-ldap (aka the Three Rings Auth-LDAP plugin for OpenVPN) 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this field and cause a buffer overflow.