Linux Distros Unpatched Vulnerability : CVE-2024-5594

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which attackers can use to inject unexpected arbitrary data into third-party executables or...

Linux Distros Unpatched Vulnerability : CVE-2024-28820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers wi...

Wavlink AC3000 Router OpenVPN Server Setup Buffer Overflow

The vulnerability of the openvpnserversetup function in the openvpn.cgi script of the Wavlink AC3000 WL-WN533A8 router software is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending...

Wavlink AC3000 Router OpenVPN Server Setup Buffer Overflow

The vulnerability of the openvpnserversetup function in the openvpn.cgi script of the Wavlink AC3000 WL-WN533A8 router software is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending...

Linux Distros Unpatched Vulnerability : CVE-2022-0547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred...

Wavlink AC3000 Router OpenVPN Server Setup Buffer Overflow

The vulnerability of the openvpnserversetup function in the openvpn.cgi script of the Wavlink AC3000 WL-WN533A8 router software is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending...

GHSA-PQ76-QJGJ-QV82 vulnerabilities

Vulnerabilities for packages: openvpn...

GHSA-PQ76-QJGJ-QV82 vulnerabilities

Vulnerabilities for packages: openvpn...

FreeBSD : security/openvpn-auth-ldap -- Fix buffer overflow in challenge/response (e915b60e-ea25-11ef-a1c0-0050569f0b83)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e915b60e-ea25-11ef-a1c0-0050569f0b83 advisory. Graham Northup reports: A buffer overflow in extractopenvpncr allows attackers with a valid LDAP userna...

Astra Linux – Vulnerability in OpenVPN

Before version 2.6.11, OpenVPN did not properly sanitize PUSHREPLY messages. This vulnerability could be exploited by attackers who control the server, allowing them to inject unexpected arbitrary data into client logs...

CVE-2024-0401

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U,...

openSUSE Security Advisory (SUSE-SU-2025:0278-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: openvpn / openvpn-auth-pam-plugin / openvpn-dco / openvpn-dco-devel / etc (SUSE-SU-2025:0278-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0278-1 advisory. - CVE-2024-5594: Fixed wrong handling of null bytes and invalid characters in control messages bsc1235147...

openvpn-2.6.10-5.1 on GA media (moderate)

openvpn-2.6.10-5.1 on GA media Announcement ID: openSUSE-SU-2025:14707-1 Rating: moderate Cross-References: CVE-2024-5594 CVSS scores: CVE-2024-5594 SUSE : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2024-5594 SUSE : 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N...

Security update for openvpn

This update for openvpn fixes the following issues: CVE-2024-5594: Fixed wrong handling of null bytes and invalid characters in control messages bsc1235147 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2025:0278-1 Security update for openvpn

This update for openvpn fixes the following issues: - CVE-2024-5594: Fixed wrong handling of null bytes and invalid characters in control messages bsc1235147...

OPENSUSE-SU-2025:14707-1 openvpn-2.6.10-5.1 on GA media

These are all security issues fixed in the openvpn-2.6.10-5.1 package on the GA media of openSUSE Tumbleweed...

OpenVPN Improper Input Sanitization Vulnerability (Jan 2025) - Windows

OpenVPN is prone to an improper input sanitization vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openvpn:openvpn...

FreeBSD : openvpn -- too long a username or password from a client can confuse openvpn servers (47bc292a-d472-11ef-aaab-7d43732cb6f5)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 47bc292a-d472-11ef-aaab-7d43732cb6f5 advisory. Frank Lichtenheld reports: OpenVPN v2.6.13 ... improve server-side handling of clients sending username...

CVE-2024-5198

OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt...