Ubuntu: Security Advisory (USN-6850-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-28820

Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...

USN-6850-1 openvpn vulnerability

It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use this issue to bypass authentication using incomplete credentials...

USN-6850-1: OpenVPN vulnerability

It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use this issue to bypass authentication using incomplete credentials...

Ubuntu 14.04 LTS / 16.04 LTS : OpenVPN vulnerability (USN-6850-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6850-1 advisory. It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use...

PT-2024-5800 · Openvpn +6 · Openvpn +6

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.0 through 2.6.10 Description: The issue is related to OpenVPN's handling of exit notifications from authenticated clients in a server role. When multiple exit notifications are accepted, it can extend the validity of a...

UBUNTU-CVE-2024-5594

OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs...

UBUNTU-CVE-2024-28882

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session...

FreeBSD : openvpn -- two security fixes (142c538e-b18f-40a1-afac-c479effadd5c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 142c538e-b18f-40a1-afac-c479effadd5c advisory. Gert Doering reports that OpenVPN 2.6.11 fixes two security bugs three on Windows:...

OPENSUSE-SU-2024:11692-1 openvpn-2.5.4-2.1 on GA media

These are all security issues fixed in the openvpn-2.5.4-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10211-1 openvpn-2.3.11-3.1 on GA media

These are all security issues fixed in the openvpn-2.3.11-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13429-1 openvpn-2.6.7-1.1 on GA media

These are all security issues fixed in the openvpn-2.6.7-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11128-1 openvpn-2.5.3-1.2 on GA media

These are all security issues fixed in the openvpn-2.5.3-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11968-1 openvpn-2.5.6-1.1 on GA media

These are all security issues fixed in the openvpn-2.5.6-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-0401 ASUS OVPN RCE

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U,...

CVE-2024-0401

CVE-2024-0401 affects multiple ASUS routers that support custom OpenVPN profiles. An authenticated, remote attacker can execute arbitrary OS commands by uploading a crafted OVPN profile, with impact on confidentiality, integrity, and availability per the cited sources. Affected models include: AS...

CVE-2024-0401 ASUS OVPN RCE

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U,...

ASUS多款产品安全漏洞

ASUS RT-AX3000 and others are products of Asus China.ASUS RT-AX3000 is a router.ASUS RT-AX88U is a wireless router.ASUS RT-AC68U is a router. A security vulnerability exists in multiple ASUS products that stems from a susceptibility to a code execution vulnerability that could allow a remote...

The vulnerability of the Node.js software library OpenVPN Connect allows a hacker to execute arbitrary code.

The vulnerability of the Node.js software product OpenVPN Connect relates to the lack of measures to neutralize instructions in the dynamically executed code. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

openvpn -- two security fixes

Gert Doering reports that OpenVPN 2.6.11 fixes two security bugs three on Windows: CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. Reynir Björnss...