CLSA-2025-1759485890 openvpn: Fix of CVE-2020-15078

CVE-2020-15078: fix authentication bypass and access to control channel data on servers configured with deferred authentication...

openvpn: Fix of CVE-2020-15078

CVE-2020-15078: fix authentication bypass and access to control channel data on servers configured with deferred authentication...

CLSA-2025-1759337779 openvpn: Fix of CVE-2020-15078

CVE-2020-15078: fix authentication bypass and access to control channel data on servers configured with deferred authentication...

FreeBSD : openvpn-devel -- script injection vulnerability from trusted but malicious server (e5cf9f44-9a64-11f0-8241-93c889bb8de1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e5cf9f44-9a64-11f0-8241-93c889bb8de1 advisory. Gert Doering reports: Notable changes beta1 - beta2 are: ... add proper input sanitation to DNS strings...

openvpn-devel -- script injection vulnerability from trusted but malicious server

Gert Doering reports: Notable changes beta1 - beta2 are: ... add proper input sanitation to DNS strings to prevent an attack coming from a trusted-but-malicous OpenVPN server CVE: 2025-10680, affects unixoid systems with --dns-updown scripts and windows using the built-in powershell call Lev...

Linux Distros Unpatched Vulnerability : CVE-2020-20813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. CVE-2020-20813 Note that Nessus reli...

[SECURITY] [DLA 4079-2] openvpn regression update

Debian LTS Advisory DLA-4079-2 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara August 31, 2025 https://wiki.debian.org/LTS Package : openvpn Version : 2.5.1-3+deb11u2 CVE ID : Debian Bug : 1112516 The upstream fix for CVE-2024-5594 released in DLA-4079...

DLA-4079-2 openvpn - regression update

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2006-2229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the...

Astra Linux – Vulnerability in OpenVPN

OpenVPN versions 2.6.1 through 2.6.13 in server mode, using TLS-crypt-v2, allow remote attackers to trigger a denial of service by corrupting and replaying network packets during the early handshake phase...

VulnCheck KEV: CVE-2024-45887

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to doOpenVPN...

The vulnerability of OpenVPN 3 Linux software for network encryption lies in the improper handling of symbolic links before accessing the file. This allows a malicious user to elevate their privileges and alter the access rights to the target directory.

The vulnerability of the OpenVPN 3 Linux network encryption software is related to incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to enhance their privileges and change access rights to the target directory...

Linux Distros Unpatched Vulnerability : CVE-2018-7544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password...

Linux Distros Unpatched Vulnerability : CVE-2025-3908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory whi...

Linux Distros Unpatched Vulnerability : CVE-2021-3773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks...

Advisory ROSA-SA-2025-2939

Software: openvpn 2.5.8 OS: ROSA-CHROME unaffected versions = openvpn-2.5.8-2 affected versions openvpn-2.5.8-2 CVE-ID: CVE-2024-4877 BDU-ID: 2025-03850 CVE-Crit: MEDIUM CVE-DESC.: An Interactive Service iservice vulnerability in the OpenVPN GUI client of the OpenVPN software is related to access...

openvpn:fuzz_verify_cert: Crash in fuzz_verify_cert

Project: https://github.com/OpenVPN/openvpn.git Detailed Report: https://oss-fuzz.com/testcase?key=6287480368463872 Project: openvpn Fuzzing Engine: honggfuzz Fuzz Target: fuzzverifycert Job Type: honggfuzzasanopenvpn Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x511000001002 Crash...

openvpn:fuzz_route: Heap-buffer-overflow in get_addr_generic

Project: https://github.com/OpenVPN/openvpn.git Detailed Report: https://oss-fuzz.com/testcase?key=5820334156873728 Project: openvpn Fuzzing Engine: honggfuzz Fuzz Target: fuzzroute Job Type: honggfuzzasanopenvpn Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address:...

CVE-2025-6776

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

CVE-2025-6776

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...