Vulnerabilites related to openvpn - openvpn
CVE-2005-2531 (GCVE-0-2005-2531)
Vulnerability from cvelistv5
Published
2005-08-24 04:00
Modified
2024-08-07 22:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:30:01.294Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "14605",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14605"
},
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "SUSE-SR:2005:020",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_20_sr.html"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16463"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.0.1, when running with \"verb 0\" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-09-23T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "14605",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14605"
},
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "SUSE-SR:2005:020",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_20_sr.html"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16463"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2531",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN before 2.0.1, when running with \"verb 0\" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "14605",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14605"
},
{
"name": "17103",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17103"
},
{
"name": "http://openvpn.net/changelog.html",
"refsource": "CONFIRM",
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "SUSE-SR:2005:020",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_20_sr.html"
},
{
"name": "DSA-851",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16463"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2531",
"datePublished": "2005-08-24T04:00:00",
"dateReserved": "2005-08-10T00:00:00",
"dateUpdated": "2024-08-07T22:30:01.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28882 (GCVE-0-2024-28882)
Vulnerability from cvelistv5
Published
2024-07-08 21:30
Modified
2024-11-01 20:38
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-772 - Missing Release of Resource after Effective Lifetime
Summary
OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-28882",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-09T14:48:10.705315Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T20:38:32.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:03:50.213Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-28882"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenVPN",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.6.10",
"status": "affected",
"version": "2.6.0",
"versionType": "patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T12:19:57.631Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-28882"
},
{
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2024-28882",
"datePublished": "2024-07-08T21:30:24.798Z",
"dateReserved": "2024-03-12T18:26:01.733Z",
"dateUpdated": "2024-11-01T20:38:32.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7522 (GCVE-0-2017-7522)
Vulnerability from cvelistv5
Published
2017-06-27 13:00
Modified
2024-08-05 16:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenVPN Technologies, Inc | OpenVPN |
Version: before 2.4.3 Version: before 2.3.17 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.857Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99230"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN",
"vendor": "OpenVPN Technologies, Inc",
"versions": [
{
"status": "affected",
"version": "before 2.4.3"
},
{
"status": "affected",
"version": "before 2.3.17"
}
]
}
],
"datePublic": "2017-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-06T09:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99230"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-7522",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN",
"version": {
"version_data": [
{
"version_value": "before 2.4.3"
},
{
"version_value": "before 2.3.17"
}
]
}
}
]
},
"vendor_name": "OpenVPN Technologies, Inc"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99230"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-7522",
"datePublished": "2017-06-27T13:00:00",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-08-05T16:04:11.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3606 (GCVE-0-2021-3606)
Vulnerability from cvelistv5
Published
2021-07-02 12:30
Modified
2024-08-03 17:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-427 - Uncontrolled Search Path Element
Summary
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | OpenVPN-GUI |
Version: 2.5.2 and prior releases |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:07.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3606"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN-GUI",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.5.2 and prior releases"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T12:30:38",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3606"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@openvpn.net",
"ID": "CVE-2021-3606",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN-GUI",
"version": {
"version_data": [
{
"version_value": "2.5.2 and prior releases"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-427 Uncontrolled Search Path Element"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3606",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3606"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2021-3606",
"datePublished": "2021-07-02T12:30:38",
"dateReserved": "2021-06-17T00:00:00",
"dateUpdated": "2024-08-03T17:01:07.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-24974 (GCVE-0-2024-24974)
Vulnerability from cvelistv5
Published
2024-07-08 10:20
Modified
2024-08-10 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints
Summary
The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "openvpn",
"vendor": "openvpn",
"versions": [
{
"lessThan": "2.5.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:openvpn:openvpn:2.6.0:-:*:*:community:*:*:*"
],
"defaultStatus": "unaffected",
"product": "openvpn",
"vendor": "openvpn",
"versions": [
{
"lessThan": "2.6.10",
"status": "affected",
"version": "2.6.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-24974",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-10T03:55:21.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.292Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"
},
{
"tags": [
"x_transferred"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Interactive Service"
],
"platforms": [
"Windows"
],
"product": "OpenVPN 2",
"vendor": "OpenVPN",
"versions": [
{
"status": "affected",
"version": "2.6.9 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-923",
"description": "Improper Restriction of Communication Channel to Intended Endpoints",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T10:22:24.212Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"
},
{
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2024-24974",
"datePublished": "2024-07-08T10:20:34.520Z",
"dateReserved": "2024-03-12T18:26:01.713Z",
"dateUpdated": "2024-08-10T03:55:21.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2704 (GCVE-0-2025-2704)
Vulnerability from cvelistv5
Published
2025-04-02 21:00
Modified
2025-04-07 17:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Summary
OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-04-03T00:11:05.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/04/02/5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-2704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-07T17:20:44.473236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-07T17:23:59.009Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenVPN",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.6.13",
"status": "affected",
"version": "2.6.1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-02T21:00:58.582Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2025-2704"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2025-2704",
"datePublished": "2025-04-02T21:00:58.582Z",
"dateReserved": "2025-03-24T10:26:42.493Z",
"dateUpdated": "2025-04-07T17:23:59.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27459 (GCVE-0-2024-27459)
Vulnerability from cvelistv5
Published
2024-07-08 10:14
Modified
2024-08-23 15:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack-based Buffer Overflow
Summary
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenVPN | OpenVPN GUI |
Version: 2.6.9 and earlier |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openvpn:openvpn_gui:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "openvpn_gui",
"vendor": "openvpn",
"versions": [
{
"lessThanOrEqual": "2.6.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27459",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-23T15:31:20.276661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-23T15:05:42.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:52.326Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27459"
},
{
"tags": [
"x_transferred"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "OpenVPN GUI",
"vendor": "OpenVPN",
"versions": [
{
"status": "affected",
"version": "2.6.9 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T10:14:38.971Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27459"
},
{
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2024-27459",
"datePublished": "2024-07-08T10:14:06.208Z",
"dateReserved": "2024-03-12T18:26:01.720Z",
"dateUpdated": "2024-08-23T15:05:42.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-2533 (GCVE-0-2005-2533)
Vulnerability from cvelistv5
Published
2005-08-24 04:00
Modified
2024-08-07 22:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:30:01.165Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16463"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.0.1, when running in \"dev tap\" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-09-23T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16463"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2533",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN before 2.0.1, when running in \"dev tap\" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "17103",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17103"
},
{
"name": "http://openvpn.net/changelog.html",
"refsource": "CONFIRM",
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16463"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2533",
"datePublished": "2005-08-24T04:00:00",
"dateReserved": "2005-08-10T00:00:00",
"dateUpdated": "2024-08-07T22:30:01.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-2532 (GCVE-0-2005-2532)
Vulnerability from cvelistv5
Published
2005-08-24 04:00
Modified
2024-08-07 22:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.
References
| ► | URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:30:01.155Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "14607",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14607"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16463"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-09-23T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "14607",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14607"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16463"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2532",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "17103",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17103"
},
{
"name": "http://openvpn.net/changelog.html",
"refsource": "CONFIRM",
"url": "http://openvpn.net/changelog.html"
},
{
"name": "MDKSA-2005:145",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "14607",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14607"
},
{
"name": "16463",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16463"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2532",
"datePublished": "2005-08-24T04:00:00",
"dateReserved": "2005-08-10T00:00:00",
"dateUpdated": "2024-08-07T22:30:01.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-46849 (GCVE-0-2023-46849)
Vulnerability from cvelistv5
Published
2023-11-11 00:05
Modified
2025-06-11 14:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-369 - Divide By Zero
Summary
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | OpenVPN | OpenVPN 2 (Community) |
Version: 2.6.0 |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:53:21.915Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46849"
},
{
"tags": [
"x_transferred"
],
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5555"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-46849",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-11T14:28:40.866061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-11T14:30:02.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenVPN 2 (Community)",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.6.6",
"status": "affected",
"version": "2.6.0",
"versionType": "minor release"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Access Server",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.11.3",
"status": "affected",
"version": "2.11.0",
"versionType": "patch release"
},
{
"lessThanOrEqual": "2.12.1",
"status": "affected",
"version": "2.12.0",
"versionType": "patch release"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "CWE-369 Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-29T02:06:19.217Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46849"
},
{
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"url": "https://www.debian.org/security/2023/dsa-5555"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2023-46849",
"datePublished": "2023-11-11T00:05:13.487Z",
"dateReserved": "2023-10-27T13:38:49.496Z",
"dateUpdated": "2025-06-11T14:30:02.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-46850 (GCVE-0-2023-46850)
Vulnerability from cvelistv5
Published
2023-11-11 00:15
Modified
2025-02-13 17:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | OpenVPN | OpenVPN 2 (Community) |
Version: 2.6.0 |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:53:21.910Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46850"
},
{
"tags": [
"x_transferred"
],
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5555"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-46850",
"options": [
{
"Exploitation": "None"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "Total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-08T21:43:36.505056Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-08T21:44:02.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenVPN 2 (Community)",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.6.6",
"status": "affected",
"version": "2.6.0",
"versionType": "minor release"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Access Server",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.11.3",
"status": "affected",
"version": "2.11.0",
"versionType": "patch release"
},
{
"lessThanOrEqual": "2.12.2",
"status": "affected",
"version": "2.12.0",
"versionType": "patch release"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-29T02:06:20.991Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46850"
},
{
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"url": "https://www.debian.org/security/2023/dsa-5555"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2023-46850",
"datePublished": "2023-11-11T00:15:07.076Z",
"dateReserved": "2023-10-27T13:38:49.496Z",
"dateUpdated": "2025-02-13T17:14:45.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-7544 (GCVE-0-2018-7544)
Vulnerability from cvelistv5
Published
2018-03-16 15:00
Modified
2024-11-14 20:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a "signal SIGTERM" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning
References
| ► | URL | Tags |
|---|---|---|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:31:04.558Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-7544",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T20:46:06.262821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T20:46:28.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-03-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a \"signal SIGTERM\" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7544",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a \"signal SIGTERM\" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html",
"refsource": "MISC",
"url": "http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7544",
"datePublished": "2018-03-16T15:00:00",
"dateReserved": "2018-02-27T00:00:00",
"dateUpdated": "2024-11-14T20:46:28.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5455 (GCVE-0-2014-5455)
Vulnerability from cvelistv5
Published
2014-08-25 16:00
Modified
2024-08-06 11:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:48:49.221Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "34037",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/34037"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html"
},
{
"name": "HPSBGN3551",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943"
},
{
"name": "109007",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/show/osvdb/109007"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/CVEProject/cvelist/pull/3909"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-01T14:58:11",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "34037",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/34037"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html"
},
{
"name": "HPSBGN3551",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943"
},
{
"name": "109007",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/show/osvdb/109007"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CVEProject/cvelist/pull/3909"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5455",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "34037",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/34037"
},
{
"name": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php",
"refsource": "MISC",
"url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php"
},
{
"name": "http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html"
},
{
"name": "HPSBGN3551",
"refsource": "HP",
"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943"
},
{
"name": "109007",
"refsource": "OSVDB",
"url": "http://osvdb.org/show/osvdb/109007"
},
{
"name": "https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d",
"refsource": "MISC",
"url": "https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d"
},
{
"name": "https://github.com/CVEProject/cvelist/pull/3909",
"refsource": "MISC",
"url": "https://github.com/CVEProject/cvelist/pull/3909"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5455",
"datePublished": "2014-08-25T16:00:00",
"dateReserved": "2014-08-25T00:00:00",
"dateUpdated": "2024-08-06T11:48:49.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4877 (GCVE-0-2024-4877)
Vulnerability from cvelistv5
Published
2025-04-03 15:11
Modified
2025-04-04 13:25
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-268 - Privilege Chaining
Summary
OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-4877",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-04T13:23:24.817604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-04T13:25:17.430Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "OpenVPN",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.6.11",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-268",
"description": "CWE-268 Privilege Chaining",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T15:11:51.057Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-4877"
},
{
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2024-4877",
"datePublished": "2025-04-03T15:11:51.057Z",
"dateReserved": "2024-05-14T17:31:57.913Z",
"dateUpdated": "2025-04-04T13:25:17.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27903 (GCVE-0-2024-27903)
Vulnerability from cvelistv5
Published
2024-07-08 10:27
Modified
2024-08-23 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-283 - Unverified Ownership
Summary
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openvpn:openvpn2:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "openvpn2",
"vendor": "openvpn",
"versions": [
{
"lessThan": "2.6.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27903",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-23T03:55:35.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:41:55.566Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"
},
{
"tags": [
"x_transferred"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Core"
],
"platforms": [
"Windows"
],
"product": "OpenVPN 2",
"vendor": "OpenVPN",
"versions": [
{
"status": "affected",
"version": "2.6.9 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-283",
"description": "Unverified Ownership",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T10:27:40.125Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"
},
{
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2024-27903",
"datePublished": "2024-07-08T10:27:40.125Z",
"dateReserved": "2024-03-12T18:26:01.705Z",
"dateUpdated": "2024-08-23T03:55:35.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-1629 (GCVE-0-2006-1629)
Vulnerability from cvelistv5
Published
2006-04-06 22:00
Modified
2024-08-07 17:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.
References
| ► | URL | Tags | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:19:48.809Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openvpn-ldpreload-code-execution(25667)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25667"
},
{
"name": "MDKSA-2006:069",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:069"
},
{
"name": "ADV-2006-1261",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1261"
},
{
"name": "17392",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17392"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/changelog.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.osreviews.net/reviews/security/openvpn-print"
},
{
"name": "19531",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19531"
},
{
"name": "DSA-1045",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2006/dsa-1045"
},
{
"name": "19598",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19598"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/mailarchive/forum.php?thread_id=10093825\u0026forum_id=8482"
},
{
"name": "19837",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19837"
},
{
"name": "24444",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/24444"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-04-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openvpn-ldpreload-code-execution(25667)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25667"
},
{
"name": "MDKSA-2006:069",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:069"
},
{
"name": "ADV-2006-1261",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1261"
},
{
"name": "17392",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17392"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/changelog.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.osreviews.net/reviews/security/openvpn-print"
},
{
"name": "19531",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19531"
},
{
"name": "DSA-1045",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2006/dsa-1045"
},
{
"name": "19598",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19598"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/mailarchive/forum.php?thread_id=10093825\u0026forum_id=8482"
},
{
"name": "19837",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19837"
},
{
"name": "24444",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/24444"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1629",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openvpn-ldpreload-code-execution(25667)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25667"
},
{
"name": "MDKSA-2006:069",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:069"
},
{
"name": "ADV-2006-1261",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1261"
},
{
"name": "17392",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17392"
},
{
"name": "http://openvpn.net/changelog.html",
"refsource": "CONFIRM",
"url": "http://openvpn.net/changelog.html"
},
{
"name": "http://www.osreviews.net/reviews/security/openvpn-print",
"refsource": "MISC",
"url": "http://www.osreviews.net/reviews/security/openvpn-print"
},
{
"name": "19531",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19531"
},
{
"name": "DSA-1045",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2006/dsa-1045"
},
{
"name": "19598",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19598"
},
{
"name": "http://sourceforge.net/mailarchive/forum.php?thread_id=10093825\u0026forum_id=8482",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/mailarchive/forum.php?thread_id=10093825\u0026forum_id=8482"
},
{
"name": "19837",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19837"
},
{
"name": "24444",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/24444"
},
{
"name": "19897",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1629",
"datePublished": "2006-04-06T22:00:00",
"dateReserved": "2006-04-05T00:00:00",
"dateUpdated": "2024-08-07T17:19:48.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2229 (GCVE-0-2006-2229)
Vulnerability from cvelistv5
Published
2006-05-05 19:00
Modified
2024-08-07 17:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:28.654Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://openvpn.net/man.html"
},
{
"name": "20060503 Re: OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433000/100/0/threaded"
},
{
"name": "20060503 Re: OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/432867/100/0/threaded"
},
{
"name": "20060503 OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/432863/100/0/threaded"
},
{
"name": "25660",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25660"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://openvpn.net/man.html"
},
{
"name": "20060503 Re: OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433000/100/0/threaded"
},
{
"name": "20060503 Re: OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/432867/100/0/threaded"
},
{
"name": "20060503 OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/432863/100/0/threaded"
},
{
"name": "25660",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25660"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2229",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://openvpn.net/man.html",
"refsource": "MISC",
"url": "http://openvpn.net/man.html"
},
{
"name": "20060503 Re: OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433000/100/0/threaded"
},
{
"name": "20060503 Re: OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/432867/100/0/threaded"
},
{
"name": "20060503 OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/432863/100/0/threaded"
},
{
"name": "25660",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25660"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2229",
"datePublished": "2006-05-05T19:00:00",
"dateReserved": "2006-05-05T00:00:00",
"dateUpdated": "2024-08-07T17:43:28.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-9336 (GCVE-0-2018-9336)
Vulnerability from cvelistv5
Published
2018-05-01 18:00
Modified
2024-08-05 07:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:17:52.100Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6"
},
{
"name": "SSA:2018-116-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE",
"x_transferred"
],
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2018\u0026m=slackware-security.568761"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2018-09"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-05T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6"
},
{
"name": "SSA:2018-116-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE"
],
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2018\u0026m=slackware-security.568761"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2018-09"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-9336",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6",
"refsource": "CONFIRM",
"url": "https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6"
},
{
"name": "SSA:2018-116-01",
"refsource": "SLACKWARE",
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2018\u0026m=slackware-security.568761"
},
{
"name": "https://www.tenable.com/security/research/tra-2018-09",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2018-09"
},
{
"name": "https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b",
"refsource": "CONFIRM",
"url": "https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-9336",
"datePublished": "2018-05-01T18:00:00",
"dateReserved": "2018-04-05T00:00:00",
"dateUpdated": "2024-08-05T07:17:52.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-6329 (GCVE-0-2016-6329)
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 01:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.
References
| ► | URL | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:29:18.449Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sweet32.info/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403"
},
{
"name": "1036695",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036695"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991482"
},
{
"name": "GLSA-201611-02",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201611-02"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SWEET32"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697"
},
{
"name": "92631",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92631"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a \"Sweet32\" attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-09T12:06:03",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sweet32.info/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403"
},
{
"name": "1036695",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036695"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991482"
},
{
"name": "GLSA-201611-02",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201611-02"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/SWEET32"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697"
},
{
"name": "92631",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92631"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-6329",
"datePublished": "2017-01-31T22:00:00",
"dateReserved": "2016-07-26T00:00:00",
"dateUpdated": "2024-08-06T01:29:18.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3547 (GCVE-0-2021-3547)
Vulnerability from cvelistv5
Published
2021-07-12 10:35
Modified
2024-08-03 17:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Summary
OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | OpenVPN 3 Core Library |
Version: 3.6 and 3.6.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:06.568Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3547"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN 3 Core Library",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "3.6 and 3.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305: Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-12T10:35:52",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3547"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@openvpn.net",
"ID": "CVE-2021-3547",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN 3 Core Library",
"version": {
"version_data": [
{
"version_value": "3.6 and 3.6.1"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305: Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3547",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3547"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2021-3547",
"datePublished": "2021-07-12T10:35:52",
"dateReserved": "2021-05-11T00:00:00",
"dateUpdated": "2024-08-03T17:01:06.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-12166 (GCVE-0-2017-12166)
Vulnerability from cvelistv5
Published
2017-10-03 19:00
Modified
2024-08-05 18:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:28:16.530Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2017-12166"
},
{
"name": "101153",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101153"
},
{
"name": "1039470",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039470"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-09-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-03T13:06:12",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2017-12166"
},
{
"name": "101153",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101153"
},
{
"name": "1039470",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039470"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-12166",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/CVE-2017-12166",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2017-12166"
},
{
"name": "101153",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101153"
},
{
"name": "1039470",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039470"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-12166",
"datePublished": "2017-10-03T19:00:00",
"dateReserved": "2017-08-01T00:00:00",
"dateUpdated": "2024-08-05T18:28:16.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-11810 (GCVE-0-2020-11810)
Vulnerability from cvelistv5
Published
2020-04-27 14:47
Modified
2024-08-04 11:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:42:00.876Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-11810"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1169925"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/ticket/1272"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://patchwork.openvpn.net/patch/1079/"
},
{
"name": "FEDORA-2020-c1cb4ebcd9",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/"
},
{
"name": "FEDORA-2020-969414e05b",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2020-04-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim\u0027s peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim\u0027s connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-03T13:06:08",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-11810"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1169925"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/ticket/1272"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://patchwork.openvpn.net/patch/1079/"
},
{
"name": "FEDORA-2020-c1cb4ebcd9",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/"
},
{
"name": "FEDORA-2020-969414e05b",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11810",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim\u0027s peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim\u0027s connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab",
"refsource": "CONFIRM",
"url": "https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab"
},
{
"name": "https://security-tracker.debian.org/tracker/CVE-2020-11810",
"refsource": "MISC",
"url": "https://security-tracker.debian.org/tracker/CVE-2020-11810"
},
{
"name": "https://bugzilla.suse.com/show_bug.cgi?id=1169925",
"refsource": "CONFIRM",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1169925"
},
{
"name": "https://community.openvpn.net/openvpn/ticket/1272",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/ticket/1272"
},
{
"name": "https://patchwork.openvpn.net/patch/1079/",
"refsource": "CONFIRM",
"url": "https://patchwork.openvpn.net/patch/1079/"
},
{
"name": "FEDORA-2020-c1cb4ebcd9",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/"
},
{
"name": "FEDORA-2020-969414e05b",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-11810",
"datePublished": "2020-04-27T14:47:01",
"dateReserved": "2020-04-15T00:00:00",
"dateUpdated": "2024-08-04T11:42:00.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3409 (GCVE-0-2005-3409)
Vulnerability from cvelistv5
Published
2005-11-02 00:00
Modified
2024-08-07 23:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.
References
| ► | URL | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:10:08.881Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "17447",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17447"
},
{
"name": "17480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17480"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "SUSE-SR:2005:025",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"name": "GLSA-200511-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"name": "15270",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15270"
},
{
"name": "OpenPKG-SA-2005.023",
"tags": [
"vendor-advisory",
"x_refsource_OPENPKG",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"name": "17452",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17452"
},
{
"name": "20416",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20416"
},
{
"name": "DSA-885",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"name": "17376",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17376"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "17447",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17447"
},
{
"name": "17480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17480"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "SUSE-SR:2005:025",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"name": "GLSA-200511-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"name": "15270",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15270"
},
{
"name": "OpenPKG-SA-2005.023",
"tags": [
"vendor-advisory",
"x_refsource_OPENPKG"
],
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"name": "17452",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17452"
},
{
"name": "20416",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20416"
},
{
"name": "DSA-885",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"name": "17376",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17376"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3409",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "17447",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17447"
},
{
"name": "17480",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17480"
},
{
"name": "http://openvpn.net/changelog.html",
"refsource": "CONFIRM",
"url": "http://openvpn.net/changelog.html"
},
{
"name": "SUSE-SR:2005:025",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"name": "GLSA-200511-07",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"name": "15270",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15270"
},
{
"name": "OpenPKG-SA-2005.023",
"refsource": "OPENPKG",
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"name": "17452",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17452"
},
{
"name": "20416",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20416"
},
{
"name": "DSA-885",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"name": "17376",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17376"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3409",
"datePublished": "2005-11-02T00:00:00",
"dateReserved": "2005-11-01T00:00:00",
"dateUpdated": "2024-08-07T23:10:08.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-8104 (GCVE-0-2014-8104)
Vulnerability from cvelistv5
Published
2014-12-03 18:00
Modified
2024-08-06 13:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
References
| ► | URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:10:50.993Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2015:139",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:139"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0512.html"
},
{
"name": "USN-2430-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2430-1"
},
{
"name": "DSA-3084",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2014/dsa-3084"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b"
},
{
"name": "openSUSE-SU-2014:1594",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-12-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-04-01T13:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "MDVSA-2015:139",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:139"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0512.html"
},
{
"name": "USN-2430-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2430-1"
},
{
"name": "DSA-3084",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2014/dsa-3084"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b"
},
{
"name": "openSUSE-SU-2014:1594",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-8104",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2015:139",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:139"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0512.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0512.html"
},
{
"name": "USN-2430-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2430-1"
},
{
"name": "DSA-3084",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2014/dsa-3084"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b"
},
{
"name": "openSUSE-SU-2014:1594",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-8104",
"datePublished": "2014-12-03T18:00:00",
"dateReserved": "2014-10-10T00:00:00",
"dateUpdated": "2024-08-06T13:10:50.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7478 (GCVE-0-2017-7478)
Vulnerability from cvelistv5
Published
2017-05-15 18:00
Modified
2024-08-05 16:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenVPN Technologies, Inc | openvpn |
Version: 2.3.12 and newer |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.580Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "41993",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/41993/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"name": "1038473",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038473"
},
{
"name": "98444",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98444"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "openvpn",
"vendor": "OpenVPN Technologies, Inc",
"versions": [
{
"status": "affected",
"version": "2.3.12 and newer"
}
]
}
],
"datePublic": "2017-05-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-15T09:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "41993",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/41993/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"name": "1038473",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038473"
},
{
"name": "98444",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98444"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-7478",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "openvpn",
"version": {
"version_data": [
{
"version_value": "2.3.12 and newer"
}
]
}
}
]
},
"vendor_name": "OpenVPN Technologies, Inc"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-617"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "41993",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/41993/"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"name": "1038473",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038473"
},
{
"name": "98444",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98444"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-7478",
"datePublished": "2017-05-15T18:00:00",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-08-05T16:04:11.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-2061 (GCVE-0-2013-2061)
Vulnerability from cvelistv5
Published
2013-11-15 18:16
Modified
2024-08-06 15:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
References
| ► | URL | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:20:37.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2013-7552",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html"
},
{
"name": "FEDORA-2013-7531",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html"
},
{
"name": "openSUSE-SU-2013:1645",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=960192"
},
{
"name": "[oss-security] 20130506 Re: CVE request: OpenVPN use of non-constant-time memcmp in HMAC comparison in openvpn_decrypt",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/05/06/6"
},
{
"name": "MDVSA-2013:167",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:167"
},
{
"name": "openSUSE-SU-2013:1649",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.gentoo.org/show_bug.cgi?id=468756"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-12-30T21:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "FEDORA-2013-7552",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html"
},
{
"name": "FEDORA-2013-7531",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html"
},
{
"name": "openSUSE-SU-2013:1645",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=960192"
},
{
"name": "[oss-security] 20130506 Re: CVE request: OpenVPN use of non-constant-time memcmp in HMAC comparison in openvpn_decrypt",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/05/06/6"
},
{
"name": "MDVSA-2013:167",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:167"
},
{
"name": "openSUSE-SU-2013:1649",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.gentoo.org/show_bug.cgi?id=468756"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-2061",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2013-7552",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html"
},
{
"name": "FEDORA-2013-7531",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html"
},
{
"name": "openSUSE-SU-2013:1645",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=960192",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=960192"
},
{
"name": "[oss-security] 20130506 Re: CVE request: OpenVPN use of non-constant-time memcmp in HMAC comparison in openvpn_decrypt",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2013/05/06/6"
},
{
"name": "MDVSA-2013:167",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:167"
},
{
"name": "openSUSE-SU-2013:1649",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html"
},
{
"name": "https://bugs.gentoo.org/show_bug.cgi?id=468756",
"refsource": "CONFIRM",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=468756"
},
{
"name": "https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee",
"refsource": "CONFIRM",
"url": "https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-2061",
"datePublished": "2013-11-15T18:16:00",
"dateReserved": "2013-02-19T00:00:00",
"dateUpdated": "2024-08-06T15:20:37.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-3459 (GCVE-0-2008-3459)
Vulnerability from cvelistv5
Published
2008-08-04 19:00
Modified
2024-08-07 09:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:37:26.960Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/index.php/documentation/change-log/changelog-21.html"
},
{
"name": "openvpn-lladdr-iproute-code-execution(44209)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44209"
},
{
"name": "30532",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30532"
},
{
"name": "1020626",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1020626"
},
{
"name": "ADV-2008-2316",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2316"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/index.php/documentation/change-log/changelog-21.html"
},
{
"name": "openvpn-lladdr-iproute-code-execution(44209)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44209"
},
{
"name": "30532",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30532"
},
{
"name": "1020626",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1020626"
},
{
"name": "ADV-2008-2316",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2316"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2008-3459",
"datePublished": "2008-08-04T19:00:00",
"dateReserved": "2008-08-04T00:00:00",
"dateUpdated": "2024-08-07T09:37:26.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3393 (GCVE-0-2005-3393)
Vulnerability from cvelistv5
Published
2005-11-01 11:00
Modified
2024-08-07 23:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option.
References
| ► | URL | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:10:08.617Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "17447",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17447"
},
{
"name": "17480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17480"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "SUSE-SR:2005:025",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"name": "GLSA-200511-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"name": "15239",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15239"
},
{
"name": "OpenPKG-SA-2005.023",
"tags": [
"vendor-advisory",
"x_refsource_OPENPKG",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"name": "17452",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17452"
},
{
"name": "ADV-2005-2255",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2255"
},
{
"name": "20051031 OpenVPN[v2.0.x]: foreign_option() formart string vulnerability.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113081023121059\u0026w=2"
},
{
"name": "DSA-885",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"name": "17376",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17376"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "17447",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17447"
},
{
"name": "17480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17480"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "SUSE-SR:2005:025",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"name": "GLSA-200511-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"name": "15239",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15239"
},
{
"name": "OpenPKG-SA-2005.023",
"tags": [
"vendor-advisory",
"x_refsource_OPENPKG"
],
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"name": "17452",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17452"
},
{
"name": "ADV-2005-2255",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2255"
},
{
"name": "20051031 OpenVPN[v2.0.x]: foreign_option() formart string vulnerability.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113081023121059\u0026w=2"
},
{
"name": "DSA-885",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"name": "17376",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17376"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3393",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "17447",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17447"
},
{
"name": "17480",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17480"
},
{
"name": "http://openvpn.net/changelog.html",
"refsource": "CONFIRM",
"url": "http://openvpn.net/changelog.html"
},
{
"name": "SUSE-SR:2005:025",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"name": "GLSA-200511-07",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"name": "15239",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15239"
},
{
"name": "OpenPKG-SA-2005.023",
"refsource": "OPENPKG",
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"name": "17452",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17452"
},
{
"name": "ADV-2005-2255",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2255"
},
{
"name": "20051031 OpenVPN[v2.0.x]: foreign_option() formart string vulnerability.",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=113081023121059\u0026w=2"
},
{
"name": "DSA-885",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"name": "17376",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17376"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3393",
"datePublished": "2005-11-01T11:00:00",
"dateReserved": "2005-11-01T00:00:00",
"dateUpdated": "2024-08-07T23:10:08.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-20813 (GCVE-0-2020-20813)
Vulnerability from cvelistv5
Published
2023-08-22 00:00
Modified
2024-10-04 16:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.
References
| ► | URL | Tags |
|---|---|---|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:22:25.545Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.freebuf.com/vuls/215171.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-20813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-04T16:21:23.113433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-04T16:22:07.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-22T15:50:58.363960",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.freebuf.com/vuls/215171.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-20813",
"datePublished": "2023-08-22T00:00:00",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-10-04T16:22:07.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7479 (GCVE-0-2017-7479)
Vulnerability from cvelistv5
Published
2017-05-15 18:00
Modified
2024-08-05 16:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenVPN Technologies, Inc | openvpn |
Version: < 2.3.15 Version: < 2.4.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.543Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"name": "1038473",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038473"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"name": "98443",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98443"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "openvpn",
"vendor": "OpenVPN Technologies, Inc",
"versions": [
{
"status": "affected",
"version": "\u003c 2.3.15"
},
{
"status": "affected",
"version": "\u003c 2.4.2"
}
]
}
],
"datePublic": "2017-05-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"name": "1038473",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038473"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"name": "98443",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98443"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-7479",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "openvpn",
"version": {
"version_data": [
{
"version_value": "\u003c 2.3.15"
},
{
"version_value": "\u003c 2.4.2"
}
]
}
}
]
},
"vendor_name": "OpenVPN Technologies, Inc"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-617"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"name": "1038473",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038473"
},
{
"name": "DSA-3900",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"name": "98443",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98443"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-7479",
"datePublished": "2017-05-15T18:00:00",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-08-05T16:04:11.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7508 (GCVE-0-2017-7508)
Vulnerability from cvelistv5
Published
2017-06-27 13:00
Modified
2024-08-05 16:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CVE-2017-7508
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenVPN Technologies, Inc | OpenVPN |
Version: before 2.4.3 Version: before 2.3.17 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.917Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN",
"vendor": "OpenVPN Technologies, Inc",
"versions": [
{
"status": "affected",
"version": "before 2.4.3"
},
{
"status": "affected",
"version": "before 2.3.17"
}
]
}
],
"datePublic": "2017-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CVE-2017-7508",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-7508",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN",
"version": {
"version_data": [
{
"version_value": "before 2.4.3"
},
{
"version_value": "before 2.3.17"
}
]
}
}
]
},
"vendor_name": "OpenVPN Technologies, Inc"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CVE-2017-7508"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3900"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-7508",
"datePublished": "2017-06-27T13:00:00",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-08-05T16:04:11.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5594 (GCVE-0-2024-5594)
Vulnerability from cvelistv5
Published
2025-01-06 13:52
Modified
2025-04-08 20:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Summary
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-5594",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-06T16:56:30.416711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T20:40:13.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenVPN",
"vendor": "OpenVPN",
"versions": [
{
"lessThan": "2.6.11",
"status": "affected",
"version": "0",
"versionType": "patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1287",
"description": "Improper Validation of Specified Type of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-02T21:00:17.688Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-5594"
},
{
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2024-5594",
"datePublished": "2025-01-06T13:52:20.272Z",
"dateReserved": "2024-06-03T08:46:40.371Z",
"dateUpdated": "2025-04-08T20:40:13.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-2534 (GCVE-0-2005-2534)
Vulnerability from cvelistv5
Published
2005-08-24 04:00
Modified
2024-08-07 22:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate.
References
| ► | URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:30:01.604Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "14610",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14610"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16463"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-09-23T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "17103",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17103"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://openvpn.net/changelog.html"
},
{
"name": "14610",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14610"
},
{
"name": "MDKSA-2005:145",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16463"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2534",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "17103",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17103"
},
{
"name": "http://openvpn.net/changelog.html",
"refsource": "CONFIRM",
"url": "http://openvpn.net/changelog.html"
},
{
"name": "14610",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14610"
},
{
"name": "MDKSA-2005:145",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"name": "DSA-851",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"name": "16463",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16463"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2534",
"datePublished": "2005-08-24T04:00:00",
"dateReserved": "2005-08-10T00:00:00",
"dateUpdated": "2024-08-07T22:30:01.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7521 (GCVE-0-2017-7521)
Vulnerability from cvelistv5
Published
2017-06-27 13:00
Modified
2024-08-05 16:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenVPN Technologies, Inc | OpenVPN |
Version: before 2.4.3 Version: before 2.3.17 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.856Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN",
"vendor": "OpenVPN Technologies, Inc",
"versions": [
{
"status": "affected",
"version": "before 2.4.3"
},
{
"status": "affected",
"version": "before 2.3.17"
}
]
}
],
"datePublic": "2017-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension()."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-7521",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN",
"version": {
"version_data": [
{
"version_value": "before 2.4.3"
},
{
"version_value": "before 2.3.17"
}
]
}
}
]
},
"vendor_name": "OpenVPN Technologies, Inc"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension()."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-400"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3900"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-7521",
"datePublished": "2017-06-27T13:00:00",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-08-05T16:04:11.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-15078 (GCVE-0-2020-15078)
Vulnerability from cvelistv5
Published
2021-04-26 13:19
Modified
2024-08-04 13:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Summary
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:08:21.675Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2021-242ef81244",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/"
},
{
"name": "FEDORA-2021-b805c26afa",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2020-15078"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"name": "FEDORA-2021-d6b9d8497b",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/"
},
{
"name": "GLSA-202105-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202105-25"
},
{
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/usn/usn-4933-1"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.5.1 and earlier versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305: Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-03T13:06:09",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"name": "FEDORA-2021-242ef81244",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/"
},
{
"name": "FEDORA-2021-b805c26afa",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2020-15078"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"name": "FEDORA-2021-d6b9d8497b",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/"
},
{
"name": "GLSA-202105-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202105-25"
},
{
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/usn/usn-4933-1"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@openvpn.net",
"ID": "CVE-2020-15078",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN",
"version": {
"version_data": [
{
"version_value": "2.5.1 and earlier versions"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305: Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2021-242ef81244",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/"
},
{
"name": "FEDORA-2021-b805c26afa",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/CVE-2020-15078",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2020-15078"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"name": "FEDORA-2021-d6b9d8497b",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/"
},
{
"name": "GLSA-202105-25",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202105-25"
},
{
"name": "https://usn.ubuntu.com/usn/usn-4933-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/usn/usn-4933-1"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2020-15078",
"datePublished": "2021-04-26T13:19:45",
"dateReserved": "2020-06-25T00:00:00",
"dateUpdated": "2024-08-04T13:08:21.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0547 (GCVE-0-2022-0547)
Vulnerability from cvelistv5
Published
2022-03-18 18:00
Modified
2025-04-23 18:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-305 - - Authentication Bypass by Primary Weakness
Summary
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
References
| ► | URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.375Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://openvpn.net/community-downloads/"
},
{
"name": "FEDORA-2022-7d46acce7c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"name": "FEDORA-2022-cb4c1146dc",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-0547",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:27:37.639278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T18:46:01.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "version 2.1 until version 2.4.12 and 2.5.6."
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 - Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-03T13:06:11.000Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://openvpn.net/community-downloads/"
},
{
"name": "FEDORA-2022-7d46acce7c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"name": "FEDORA-2022-cb4c1146dc",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@openvpn.net",
"ID": "CVE-2022-0547",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN",
"version": {
"version_data": [
{
"version_value": "version 2.1 until version 2.4.12 and 2.5.6."
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305 - Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"name": "https://openvpn.net/community-downloads/",
"refsource": "MISC",
"url": "https://openvpn.net/community-downloads/"
},
{
"name": "FEDORA-2022-7d46acce7c",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"name": "FEDORA-2022-cb4c1146dc",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2022-0547",
"datePublished": "2022-03-18T18:00:20.000Z",
"dateReserved": "2022-02-08T00:00:00.000Z",
"dateUpdated": "2025-04-23T18:46:01.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7520 (GCVE-0-2017-7520)
Vulnerability from cvelistv5
Published
2017-06-27 13:00
Modified
2024-08-05 16:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenVPN Technologies, Inc | OpenVPN |
Version: before 2.4.3 Version: before 2.3.17 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.764Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN",
"vendor": "OpenVPN Technologies, Inc",
"versions": [
{
"status": "affected",
"version": "before 2.4.3"
},
{
"status": "affected",
"version": "before 2.3.17"
}
]
}
],
"datePublic": "2017-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3900"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2017-7520",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN",
"version": {
"version_data": [
{
"version_value": "before 2.4.3"
},
{
"version_value": "before 2.3.17"
}
]
}
}
]
},
"vendor_name": "OpenVPN Technologies, Inc"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243",
"refsource": "CONFIRM",
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"name": "1038768",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"name": "99230",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99230"
},
{
"name": "DSA-3900",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3900"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2017-7520",
"datePublished": "2017-06-27T13:00:00",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-08-05T16:04:11.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-7235 (GCVE-0-2023-7235)
Vulnerability from cvelistv5
Published
2024-02-21 10:55
Modified
2024-08-26 16:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-276 - Incorrect Default Permissions
Summary
The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:57:35.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-7235"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "openvpn",
"vendor": "openvpn",
"versions": [
{
"lessThanOrEqual": "2.6.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-7235",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-26T16:50:36.232236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-26T16:13:36.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "OpenVPN",
"vendor": "OpenVPN",
"versions": [
{
"lessThanOrEqual": "2.6.8",
"status": "affected",
"version": "0",
"versionType": "all releases"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T10:55:15.487Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-7235"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2023-7235",
"datePublished": "2024-02-21T10:55:15.487Z",
"dateReserved": "2024-01-16T15:21:16.217Z",
"dateUpdated": "2024-08-26T16:13:36.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2020-04-27 15:15
Modified
2024-11-21 04:58
Severity ?
Summary
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1169925 | Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://community.openvpn.net/openvpn/ticket/1272 | Exploit, Vendor Advisory | |
| cve@mitre.org | https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab | Patch, Third Party Advisory | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/ | ||
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/ | ||
| cve@mitre.org | https://patchwork.openvpn.net/patch/1079/ | Patch, Vendor Advisory | |
| cve@mitre.org | https://security-tracker.debian.org/tracker/CVE-2020-11810 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.suse.com/show_bug.cgi?id=1169925 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/ticket/1272 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://patchwork.openvpn.net/patch/1079/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security-tracker.debian.org/tracker/CVE-2020-11810 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | * | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 32 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3D4C2FC1-8BC0-4588-85C3-FC6D3B84D3F6",
"versionEndExcluding": "2.4.9",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim\u0027s peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim\u0027s connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en OpenVPN versiones 2.4.x versiones anteriores a 2.4.9. Un atacante puede inyectar un paquete de canal de datos v2 (P_DATA_V2) usando el peer-id de la v\u00edctima. Normalmente, estos paquetes son eliminados, pero si este paquete llega antes de que se hayan inicializado los par\u00e1metros de cifrado del canal de datos, se eliminar\u00e1 la conexi\u00f3n de la v\u00edctima. Esto requiere una sincronizaci\u00f3n cuidadosa debido a una peque\u00f1a ventana de tiempo (normalmente unos pocos segundos) entre el inicio de la conexi\u00f3n del cliente v\u00edctima y la respuesta PUSH_REPLY del servidor al cliente. Este ataque s\u00f3lo funcionar\u00e1 si Negotiable Cipher Parameters (NCP) est\u00e1 en uso."
}
],
"id": "CVE-2020-11810",
"lastModified": "2024-11-21T04:58:40.587",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-04-27T15:15:12.407",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1169925"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/ticket/1272"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://patchwork.openvpn.net/patch/1079/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-11810"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1169925"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/ticket/1272"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGHHV4YZANZW45KZTJJGVGPFMSXYRCKZ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JII7RYYYRBPQNEGGVSOXCM7JUZ43T3VH/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://patchwork.openvpn.net/patch/1079/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-11810"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-11-11 01:15
Modified
2024-11-21 08:29
Severity ?
Summary
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2023-46850 | Vendor Advisory | |
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ | Mailing List | |
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/ | ||
| security@openvpn.net | https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ | Vendor Advisory | |
| security@openvpn.net | https://www.debian.org/security/2023/dsa-5555 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2023-46850 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ | Mailing List | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2023/dsa-5555 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | * | |
| openvpn | openvpn_access_server | * | |
| openvpn | openvpn_access_server | * | |
| debian | debian_linux | 12.0 | |
| fedoraproject | fedora | 39 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "3A398A7A-395F-4CA8-9D72-1DDD337D5074",
"versionEndIncluding": "2.6.6",
"versionStartIncluding": "2.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54464223-5988-40E7-B94B-D7B8DE999704",
"versionEndIncluding": "2.11.3",
"versionStartIncluding": "2.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B8D0B4E-A0BF-4A33-9031-987D8BD45F65",
"versionEndExcluding": "2.12.2",
"versionStartIncluding": "2.12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer."
},
{
"lang": "es",
"value": "Use after free en OpenVPN versi\u00f3n 2.6.0 a 2.6.6 puede provocar un comportamiento indefinido, p\u00e9rdida de b\u00faferes de memoria o ejecuci\u00f3n remota al enviar b\u00faferes de red a un par remoto."
}
],
"id": "CVE-2023-46850",
"lastModified": "2024-11-21T08:29:25.480",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-11T01:15:07.357",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46850"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"source": "security@openvpn.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"source": "security@openvpn.net",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5555"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46850"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5555"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-03-18 18:15
Modified
2025-04-23 19:15
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2022-0547 | Vendor Advisory | |
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Vendor Advisory | |
| security@openvpn.net | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory | |
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/ | ||
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/ | ||
| security@openvpn.net | https://openvpn.net/community-downloads/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2022-0547 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://openvpn.net/community-downloads/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | * | |
| openvpn | openvpn | * | |
| fedoraproject | fedora | 34 | |
| fedoraproject | fedora | 36 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3DCBC37F-7869-42AE-B343-456FC9416C90",
"versionEndExcluding": "2.4.12",
"versionStartIncluding": "2.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "964D0D5A-F643-40FB-A051-E9DC5F859A1C",
"versionEndExcluding": "2.5.6",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
"matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials."
},
{
"lang": "es",
"value": "OpenVPN versiones 2.1 hasta v2.4.12 y versi\u00f3n v2.5.6, puede permitir una omisi\u00f3n de autenticaci\u00f3n en los complementos de autenticaci\u00f3n externa cuando m\u00e1s de uno de ellos hace uso de las respuestas de autenticaci\u00f3n diferida, lo que permite que sea concedido acceso a un usuario externo con credenciales s\u00f3lo parcialmente correctas"
}
],
"id": "CVE-2022-0547",
"lastModified": "2025-04-23T19:15:52.743",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2022-03-18T18:15:12.017",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"source": "security@openvpn.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"source": "security@openvpn.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"source": "security@openvpn.net",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://openvpn.net/community-downloads/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://openvpn.net/community-downloads/"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-305"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-05-01 18:29
Modified
2024-11-21 04:15
Severity ?
Summary
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.568761 | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b | Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6 | Release Notes, Third Party Advisory | |
| cve@mitre.org | https://www.tenable.com/security/research/tra-2018-09 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.568761 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6 | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.tenable.com/security/research/tra-2018-09 | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | * | |
| slackware | slackware_linux | 13.0 | |
| slackware | slackware_linux | 13.1 | |
| slackware | slackware_linux | 13.37 | |
| slackware | slackware_linux | 14.0 | |
| slackware | slackware_linux | 14.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6562B69D-6751-4915-89C8-4675EFEEBB1A",
"versionEndExcluding": "2.4.6",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7547FBB1-AFE8-4DCB-9B6D-0EB719D26FB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "64DF28B6-C9FE-44AD-9D09-2F154819AFA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*",
"matchCriteriaId": "1A153230-E0BE-4323-AC73-44E8DCD14A1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:slackware:slackware_linux:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "936EF68B-2A93-402C-BED4-20E6EDB2F102",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:slackware:slackware_linux:14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F1B46F08-93A8-49D9-AC5D-43E19C062FFA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation."
},
{
"lang": "es",
"value": "openvpnserv.exe (tambi\u00e9n conocido como interactive service helper) en OpenVPN en versiones 2.4.x anteriores a la 2.4.6 permite que un atacante local provoque una doble liberaci\u00f3n (double free) de memoria enviando una petici\u00f3n mal formada al servicio interactivo. Esto podr\u00eda provocar una denegaci\u00f3n de servicio (DoS) al corromper la memoria o, posiblemente, otro impacto no especificado, incluyendo el escalado de privilegios."
}
],
"id": "CVE-2018-9336",
"lastModified": "2024-11-21T04:15:21.590",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-05-01T18:29:00.697",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2018\u0026m=slackware-security.568761"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2018-09"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2018\u0026m=slackware-security.568761"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2018-09"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-415"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-07-08 22:15
Modified
2025-06-10 16:26
Severity ?
Summary
OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2024-28882 | Vendor Advisory | |
| security@openvpn.net | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html | Mailing List | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2024-28882 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html | Mailing List |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "0D6C4FD9-4627-4A45-89FC-2DB53985C516",
"versionEndExcluding": "2.6.11",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session"
},
{
"lang": "es",
"value": "OpenVPN 2.6.10 y versiones anteriores en una funci\u00f3n de servidor aceptan m\u00faltiples notificaciones de salida de clientes autenticados que extender\u00e1n la validez de una sesi\u00f3n de cierre"
}
],
"id": "CVE-2024-28882",
"lastModified": "2025-06-10T16:26:09.473",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2024-07-08T22:15:02.410",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-28882"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-28882"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-772"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-11-02 00:02
Modified
2025-04-03 01:03
Severity ?
Summary
OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openvpn.net/changelog.html | ||
| cve@mitre.org | http://secunia.com/advisories/17376 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17447 | ||
| cve@mitre.org | http://secunia.com/advisories/17452 | ||
| cve@mitre.org | http://secunia.com/advisories/17480 | ||
| cve@mitre.org | http://www.debian.org/security/2005/dsa-885 | ||
| cve@mitre.org | http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml | ||
| cve@mitre.org | http://www.novell.com/linux/security/advisories/2005_25_sr.html | ||
| cve@mitre.org | http://www.osvdb.org/20416 | ||
| cve@mitre.org | http://www.securityfocus.com/archive/1/415487 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/15270 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/changelog.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17376 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17447 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17452 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17480 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2005/dsa-885 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.novell.com/linux/security/advisories/2005_25_sr.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/20416 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/415487 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15270 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0.1_rc1 | |
| openvpn | openvpn | 2.0.1_rc2 | |
| openvpn | openvpn | 2.0.1_rc3 | |
| openvpn | openvpn | 2.0.1_rc4 | |
| openvpn | openvpn | 2.0.1_rc5 | |
| openvpn | openvpn | 2.0.1_rc6 | |
| openvpn | openvpn | 2.0.1_rc7 | |
| openvpn | openvpn | 2.0.2_rc1 | |
| openvpn | openvpn | 2.0.3_rc1 | |
| openvpn | openvpn | 2.0_beta1 | |
| openvpn | openvpn | 2.0_beta2 | |
| openvpn | openvpn | 2.0_beta3 | |
| openvpn | openvpn | 2.0_beta4 | |
| openvpn | openvpn | 2.0_beta5 | |
| openvpn | openvpn | 2.0_beta6 | |
| openvpn | openvpn | 2.0_beta7 | |
| openvpn | openvpn | 2.0_beta8 | |
| openvpn | openvpn | 2.0_beta9 | |
| openvpn | openvpn | 2.0_beta10 | |
| openvpn | openvpn | 2.0_beta11 | |
| openvpn | openvpn | 2.0_beta12 | |
| openvpn | openvpn | 2.0_beta13 | |
| openvpn | openvpn | 2.0_beta15 | |
| openvpn | openvpn | 2.0_beta16 | |
| openvpn | openvpn | 2.0_beta17 | |
| openvpn | openvpn | 2.0_beta18 | |
| openvpn | openvpn | 2.0_beta19 | |
| openvpn | openvpn | 2.0_beta20 | |
| openvpn | openvpn | 2.0_beta28 | |
| openvpn | openvpn | 2.0_rc1 | |
| openvpn | openvpn | 2.0_rc2 | |
| openvpn | openvpn | 2.0_rc3 | |
| openvpn | openvpn | 2.0_rc4 | |
| openvpn | openvpn | 2.0_rc5 | |
| openvpn | openvpn | 2.0_rc6 | |
| openvpn | openvpn | 2.0_rc7 | |
| openvpn | openvpn | 2.0_rc8 | |
| openvpn | openvpn | 2.0_rc9 | |
| openvpn | openvpn | 2.0_rc10 | |
| openvpn | openvpn | 2.0_rc11 | |
| openvpn | openvpn | 2.0_rc12 | |
| openvpn | openvpn | 2.0_rc13 | |
| openvpn | openvpn | 2.0_rc14 | |
| openvpn | openvpn | 2.0_rc15 | |
| openvpn | openvpn | 2.0_rc16 | |
| openvpn | openvpn | 2.0_rc17 | |
| openvpn | openvpn | 2.0_rc18 | |
| openvpn | openvpn | 2.0_rc19 | |
| openvpn | openvpn | 2.0_rc20 | |
| openvpn | openvpn | 2.0_rc21 | |
| openvpn | openvpn | 2.0_test1 | |
| openvpn | openvpn | 2.0_test2 | |
| openvpn | openvpn | 2.0_test3 | |
| openvpn | openvpn | 2.0_test5 | |
| openvpn | openvpn | 2.0_test6 | |
| openvpn | openvpn | 2.0_test7 | |
| openvpn | openvpn | 2.0_test8 | |
| openvpn | openvpn | 2.0_test9 | |
| openvpn | openvpn | 2.0_test10 | |
| openvpn | openvpn | 2.0_test11 | |
| openvpn | openvpn | 2.0_test12 | |
| openvpn | openvpn | 2.0_test14 | |
| openvpn | openvpn | 2.0_test15 | |
| openvpn | openvpn | 2.0_test16 | |
| openvpn | openvpn | 2.0_test17 | |
| openvpn | openvpn | 2.0_test18 | |
| openvpn | openvpn | 2.0_test19 | |
| openvpn | openvpn | 2.0_test20 | |
| openvpn | openvpn | 2.0_test21 | |
| openvpn | openvpn | 2.0_test22 | |
| openvpn | openvpn | 2.0_test23 | |
| openvpn | openvpn | 2.0_test24 | |
| openvpn | openvpn | 2.0_test26 | |
| openvpn | openvpn | 2.0_test27 | |
| openvpn | openvpn | 2.0_test29 | |
| openvpn | openvpn_access_server | 2.0.1 | |
| openvpn | openvpn_access_server | 2.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8D0ECEAF-401A-434E-9B0A-1A234BAEFC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "E751FA0E-0DF4-4F81-912A-1A132640246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "43F61AC6-EDF6-4818-BA51-3EAA299680B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "D32984D8-9631-407B-834E-303B9405A425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB44A872-3FE2-47E9-BA84-B6E1015E1973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "F020080D-7181-400D-988E-6844D1653464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "86D08038-9815-4222-9CD3-1211FE5954A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CE43EA96-5B3C-498F-A040-C800821DA49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.3_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "236F2BBF-0CF5-465E-9E65-8AD6D17F57A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "2BDEBEDA-437A-4942-8A71-7B25DD558BCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EB8A78E-DAB9-4A72-BC54-58230E1E9B9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta3:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D74ED1-34C5-4F95-A941-83664AFFF2ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta4:*:*:*:*:*:*:*",
"matchCriteriaId": "0747C1A9-C404-4FBD-AA8F-9DBB70FEB4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta5:*:*:*:*:*:*:*",
"matchCriteriaId": "5A3B1AD4-9EA0-4D86-90E1-3366FBC5629D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta6:*:*:*:*:*:*:*",
"matchCriteriaId": "8E483BD0-CAB9-4DA0-AAA4-A934B8318FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F04FAB1-A558-4F93-9FBF-043DE259A813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta8:*:*:*:*:*:*:*",
"matchCriteriaId": "A189A733-3130-41B4-94DD-E99E294D0FBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta9:*:*:*:*:*:*:*",
"matchCriteriaId": "7DEE5695-DC49-445D-864A-4739E16DF762",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta10:*:*:*:*:*:*:*",
"matchCriteriaId": "6FBF146F-2CFA-4F14-BFBC-E01B58F9F72B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5D263CA-8B2C-4B66-8990-6224BAF52A8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta12:*:*:*:*:*:*:*",
"matchCriteriaId": "825C9FCE-AD76-4E32-8FEC-EEFA0662BC04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta13:*:*:*:*:*:*:*",
"matchCriteriaId": "2C7519FA-831A-41D7-AFC3-B9457E6DFB4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta15:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB79AFD-493F-41F1-9EC1-8BCC0D28A914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta16:*:*:*:*:*:*:*",
"matchCriteriaId": "2C8F091B-194A-4FC5-87F4-A76CB490F3F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta17:*:*:*:*:*:*:*",
"matchCriteriaId": "11716B49-A920-4A1B-BEA5-4105213B9731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta18:*:*:*:*:*:*:*",
"matchCriteriaId": "756A7AF5-E502-4EDC-9693-4041C993E3BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta19:*:*:*:*:*:*:*",
"matchCriteriaId": "9885BC3E-1854-4561-9906-FFAEECA5B6FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta20:*:*:*:*:*:*:*",
"matchCriteriaId": "D7B7759F-F228-436D-BC86-7317B0109C02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta28:*:*:*:*:*:*:*",
"matchCriteriaId": "ADB9BD19-1BF9-42D0-9E43-7D95EE010347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0A6E23-6456-4305-A7DA-8CA1D506D4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "D985B9F0-5B4F-4120-8ECF-506C5F6179FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "CF7E6096-58BF-47F1-982B-27A9ED735AEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "62362541-FE20-47ED-9E03-94216A3D43CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BD7019-BBA5-4D08-85C8-571D2EC03FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1D56A4-A03C-445C-993B-1AA12024D4FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "F563B1FD-FC1F-4304-8141-A1188A190835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc8:*:*:*:*:*:*:*",
"matchCriteriaId": "4269ED1A-3031-4572-B134-62C6E533D176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc9:*:*:*:*:*:*:*",
"matchCriteriaId": "140999A7-E9BB-4459-B3F8-48DF8F5DFE0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc10:*:*:*:*:*:*:*",
"matchCriteriaId": "41CD75B0-24D0-40BA-A4FB-925BD5414298",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc11:*:*:*:*:*:*:*",
"matchCriteriaId": "DED8F3C5-8E43-4B07-8224-38BF4774F4CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc12:*:*:*:*:*:*:*",
"matchCriteriaId": "3EC88614-E782-447B-B854-955498FAAA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc13:*:*:*:*:*:*:*",
"matchCriteriaId": "D2C1B8EE-3C12-452F-986E-6FD8A230685A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc14:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AC6851-F63E-47D7-BDEF-3BFF39E94D9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc15:*:*:*:*:*:*:*",
"matchCriteriaId": "685F5555-793D-4FAA-8CF4-578490CFAC6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc16:*:*:*:*:*:*:*",
"matchCriteriaId": "E688CF0C-134B-49E2-AEB3-45ECACB8B5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc17:*:*:*:*:*:*:*",
"matchCriteriaId": "1D385327-D1FF-4A22-A0C0-0C5AA53590C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc18:*:*:*:*:*:*:*",
"matchCriteriaId": "51329755-1DBF-40E1-960C-E924CDC4B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc19:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE65AC5-C218-456F-86FB-1C8BEC3C4598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc20:*:*:*:*:*:*:*",
"matchCriteriaId": "1412133F-3B44-43B6-A4FF-FF80E7B564E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc21:*:*:*:*:*:*:*",
"matchCriteriaId": "B55EE355-28A1-4955-9ADD-A8E02376C9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test1:*:*:*:*:*:*:*",
"matchCriteriaId": "E942C13E-6B54-465F-8026-ED49BD7EA2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test2:*:*:*:*:*:*:*",
"matchCriteriaId": "AADF30CF-AD36-45EB-AF50-EB0533B20B70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD078F82-361C-4B38-86E8-85E129F41A36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9831C92-7717-4650-8689-3C41B773C5CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test6:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3521E7-572E-4ADD-AAF6-F1AE505B4BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test7:*:*:*:*:*:*:*",
"matchCriteriaId": "F73290B2-384B-4B0F-8763-EF4D5D7C39FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test8:*:*:*:*:*:*:*",
"matchCriteriaId": "4728B3CD-5B54-4B0B-8967-DE7D9E1474F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test9:*:*:*:*:*:*:*",
"matchCriteriaId": "F353B495-D69A-4831-9E5B-F15F8F749C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test10:*:*:*:*:*:*:*",
"matchCriteriaId": "16647409-3ADD-4E86-A053-4A7B8365700E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5CA9F6-68FE-4412-8CD5-F85E970249F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test12:*:*:*:*:*:*:*",
"matchCriteriaId": "74A74354-1EAB-4A4F-A79C-C04E9BCDF594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test14:*:*:*:*:*:*:*",
"matchCriteriaId": "03A016A3-CAA9-4FCB-B909-F4163CE1E19E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test15:*:*:*:*:*:*:*",
"matchCriteriaId": "82A53B7C-8E9D-4DD6-8B00-628F7796A365",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test16:*:*:*:*:*:*:*",
"matchCriteriaId": "3D5AADA5-05DA-4660-9636-A3B737916A0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test17:*:*:*:*:*:*:*",
"matchCriteriaId": "2778FEDE-063B-4454-9FA7-F526334CF9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test18:*:*:*:*:*:*:*",
"matchCriteriaId": "989D471D-3F81-4018-A124-7FBEB3F4AB87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test19:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EA97AE-B2DD-40F8-81E1-467E895CE736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test20:*:*:*:*:*:*:*",
"matchCriteriaId": "F0C82A6A-4548-4508-B337-1061E57D78AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test21:*:*:*:*:*:*:*",
"matchCriteriaId": "36A972BC-6956-4195-933C-F3694BFEFB50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test22:*:*:*:*:*:*:*",
"matchCriteriaId": "E9EF5187-C008-4927-B5CB-A491768E9822",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test23:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A39ECE-7C8D-4BB8-A408-08EA0879F03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test24:*:*:*:*:*:*:*",
"matchCriteriaId": "6C67474C-3274-4F62-AF98-6953F9744522",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test26:*:*:*:*:*:*:*",
"matchCriteriaId": "D799CAF5-BFC3-4A80-8AE2-D292B7F9D9CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test27:*:*:*:*:*:*:*",
"matchCriteriaId": "98D3B905-FCD7-4136-A94C-76A95994CD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test29:*:*:*:*:*:*:*",
"matchCriteriaId": "1AE172A1-D9A5-4FF7-B316-4E0BD639B35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B42CB75B-355B-4D80-91EA-77723B275D0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E5EFEC7-D9B6-454A-A36A-C75874564FCF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler."
}
],
"id": "CVE-2005-3409",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-11-02T00:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17376"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17447"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17452"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17480"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/20416"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17376"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17447"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17452"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17480"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/20416"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15270"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-08-24 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openvpn.net/changelog.html | ||
| cve@mitre.org | http://secunia.com/advisories/16463 | ||
| cve@mitre.org | http://secunia.com/advisories/17103 | ||
| cve@mitre.org | http://www.debian.org/security/2005/dsa-851 | ||
| cve@mitre.org | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/changelog.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/16463 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17103 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2005/dsa-851 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0.1_rc1 | |
| openvpn | openvpn | 2.0.1_rc2 | |
| openvpn | openvpn | 2.0.1_rc3 | |
| openvpn | openvpn | 2.0.1_rc4 | |
| openvpn | openvpn | 2.0.1_rc5 | |
| openvpn | openvpn | 2.0.1_rc6 | |
| openvpn | openvpn | 2.0.1_rc7 | |
| openvpn | openvpn | 2.0_beta1 | |
| openvpn | openvpn | 2.0_beta2 | |
| openvpn | openvpn | 2.0_beta3 | |
| openvpn | openvpn | 2.0_beta4 | |
| openvpn | openvpn | 2.0_beta5 | |
| openvpn | openvpn | 2.0_beta6 | |
| openvpn | openvpn | 2.0_beta7 | |
| openvpn | openvpn | 2.0_beta8 | |
| openvpn | openvpn | 2.0_beta9 | |
| openvpn | openvpn | 2.0_beta10 | |
| openvpn | openvpn | 2.0_beta11 | |
| openvpn | openvpn | 2.0_beta12 | |
| openvpn | openvpn | 2.0_beta13 | |
| openvpn | openvpn | 2.0_beta15 | |
| openvpn | openvpn | 2.0_beta16 | |
| openvpn | openvpn | 2.0_beta17 | |
| openvpn | openvpn | 2.0_beta18 | |
| openvpn | openvpn | 2.0_beta19 | |
| openvpn | openvpn | 2.0_beta20 | |
| openvpn | openvpn | 2.0_beta28 | |
| openvpn | openvpn | 2.0_rc1 | |
| openvpn | openvpn | 2.0_rc2 | |
| openvpn | openvpn | 2.0_rc3 | |
| openvpn | openvpn | 2.0_rc4 | |
| openvpn | openvpn | 2.0_rc5 | |
| openvpn | openvpn | 2.0_rc6 | |
| openvpn | openvpn | 2.0_rc7 | |
| openvpn | openvpn | 2.0_rc8 | |
| openvpn | openvpn | 2.0_rc9 | |
| openvpn | openvpn | 2.0_rc10 | |
| openvpn | openvpn | 2.0_rc11 | |
| openvpn | openvpn | 2.0_rc12 | |
| openvpn | openvpn | 2.0_rc13 | |
| openvpn | openvpn | 2.0_rc14 | |
| openvpn | openvpn | 2.0_rc15 | |
| openvpn | openvpn | 2.0_rc16 | |
| openvpn | openvpn | 2.0_rc17 | |
| openvpn | openvpn | 2.0_rc18 | |
| openvpn | openvpn | 2.0_rc19 | |
| openvpn | openvpn | 2.0_rc20 | |
| openvpn | openvpn | 2.0_rc21 | |
| openvpn | openvpn | 2.0_test1 | |
| openvpn | openvpn | 2.0_test2 | |
| openvpn | openvpn | 2.0_test3 | |
| openvpn | openvpn | 2.0_test5 | |
| openvpn | openvpn | 2.0_test6 | |
| openvpn | openvpn | 2.0_test7 | |
| openvpn | openvpn | 2.0_test8 | |
| openvpn | openvpn | 2.0_test9 | |
| openvpn | openvpn | 2.0_test10 | |
| openvpn | openvpn | 2.0_test11 | |
| openvpn | openvpn | 2.0_test12 | |
| openvpn | openvpn | 2.0_test14 | |
| openvpn | openvpn | 2.0_test15 | |
| openvpn | openvpn | 2.0_test16 | |
| openvpn | openvpn | 2.0_test17 | |
| openvpn | openvpn | 2.0_test18 | |
| openvpn | openvpn | 2.0_test19 | |
| openvpn | openvpn | 2.0_test20 | |
| openvpn | openvpn | 2.0_test21 | |
| openvpn | openvpn | 2.0_test22 | |
| openvpn | openvpn | 2.0_test23 | |
| openvpn | openvpn | 2.0_test24 | |
| openvpn | openvpn | 2.0_test26 | |
| openvpn | openvpn | 2.0_test27 | |
| openvpn | openvpn | 2.0_test29 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8D0ECEAF-401A-434E-9B0A-1A234BAEFC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "E751FA0E-0DF4-4F81-912A-1A132640246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "43F61AC6-EDF6-4818-BA51-3EAA299680B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "D32984D8-9631-407B-834E-303B9405A425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB44A872-3FE2-47E9-BA84-B6E1015E1973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "F020080D-7181-400D-988E-6844D1653464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "86D08038-9815-4222-9CD3-1211FE5954A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "2BDEBEDA-437A-4942-8A71-7B25DD558BCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EB8A78E-DAB9-4A72-BC54-58230E1E9B9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta3:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D74ED1-34C5-4F95-A941-83664AFFF2ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta4:*:*:*:*:*:*:*",
"matchCriteriaId": "0747C1A9-C404-4FBD-AA8F-9DBB70FEB4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta5:*:*:*:*:*:*:*",
"matchCriteriaId": "5A3B1AD4-9EA0-4D86-90E1-3366FBC5629D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta6:*:*:*:*:*:*:*",
"matchCriteriaId": "8E483BD0-CAB9-4DA0-AAA4-A934B8318FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F04FAB1-A558-4F93-9FBF-043DE259A813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta8:*:*:*:*:*:*:*",
"matchCriteriaId": "A189A733-3130-41B4-94DD-E99E294D0FBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta9:*:*:*:*:*:*:*",
"matchCriteriaId": "7DEE5695-DC49-445D-864A-4739E16DF762",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta10:*:*:*:*:*:*:*",
"matchCriteriaId": "6FBF146F-2CFA-4F14-BFBC-E01B58F9F72B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5D263CA-8B2C-4B66-8990-6224BAF52A8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta12:*:*:*:*:*:*:*",
"matchCriteriaId": "825C9FCE-AD76-4E32-8FEC-EEFA0662BC04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta13:*:*:*:*:*:*:*",
"matchCriteriaId": "2C7519FA-831A-41D7-AFC3-B9457E6DFB4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta15:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB79AFD-493F-41F1-9EC1-8BCC0D28A914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta16:*:*:*:*:*:*:*",
"matchCriteriaId": "2C8F091B-194A-4FC5-87F4-A76CB490F3F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta17:*:*:*:*:*:*:*",
"matchCriteriaId": "11716B49-A920-4A1B-BEA5-4105213B9731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta18:*:*:*:*:*:*:*",
"matchCriteriaId": "756A7AF5-E502-4EDC-9693-4041C993E3BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta19:*:*:*:*:*:*:*",
"matchCriteriaId": "9885BC3E-1854-4561-9906-FFAEECA5B6FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta20:*:*:*:*:*:*:*",
"matchCriteriaId": "D7B7759F-F228-436D-BC86-7317B0109C02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta28:*:*:*:*:*:*:*",
"matchCriteriaId": "ADB9BD19-1BF9-42D0-9E43-7D95EE010347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0A6E23-6456-4305-A7DA-8CA1D506D4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "D985B9F0-5B4F-4120-8ECF-506C5F6179FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "CF7E6096-58BF-47F1-982B-27A9ED735AEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "62362541-FE20-47ED-9E03-94216A3D43CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BD7019-BBA5-4D08-85C8-571D2EC03FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1D56A4-A03C-445C-993B-1AA12024D4FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "F563B1FD-FC1F-4304-8141-A1188A190835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc8:*:*:*:*:*:*:*",
"matchCriteriaId": "4269ED1A-3031-4572-B134-62C6E533D176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc9:*:*:*:*:*:*:*",
"matchCriteriaId": "140999A7-E9BB-4459-B3F8-48DF8F5DFE0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc10:*:*:*:*:*:*:*",
"matchCriteriaId": "41CD75B0-24D0-40BA-A4FB-925BD5414298",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc11:*:*:*:*:*:*:*",
"matchCriteriaId": "DED8F3C5-8E43-4B07-8224-38BF4774F4CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc12:*:*:*:*:*:*:*",
"matchCriteriaId": "3EC88614-E782-447B-B854-955498FAAA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc13:*:*:*:*:*:*:*",
"matchCriteriaId": "D2C1B8EE-3C12-452F-986E-6FD8A230685A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc14:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AC6851-F63E-47D7-BDEF-3BFF39E94D9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc15:*:*:*:*:*:*:*",
"matchCriteriaId": "685F5555-793D-4FAA-8CF4-578490CFAC6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc16:*:*:*:*:*:*:*",
"matchCriteriaId": "E688CF0C-134B-49E2-AEB3-45ECACB8B5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc17:*:*:*:*:*:*:*",
"matchCriteriaId": "1D385327-D1FF-4A22-A0C0-0C5AA53590C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc18:*:*:*:*:*:*:*",
"matchCriteriaId": "51329755-1DBF-40E1-960C-E924CDC4B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc19:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE65AC5-C218-456F-86FB-1C8BEC3C4598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc20:*:*:*:*:*:*:*",
"matchCriteriaId": "1412133F-3B44-43B6-A4FF-FF80E7B564E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc21:*:*:*:*:*:*:*",
"matchCriteriaId": "B55EE355-28A1-4955-9ADD-A8E02376C9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test1:*:*:*:*:*:*:*",
"matchCriteriaId": "E942C13E-6B54-465F-8026-ED49BD7EA2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test2:*:*:*:*:*:*:*",
"matchCriteriaId": "AADF30CF-AD36-45EB-AF50-EB0533B20B70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD078F82-361C-4B38-86E8-85E129F41A36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9831C92-7717-4650-8689-3C41B773C5CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test6:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3521E7-572E-4ADD-AAF6-F1AE505B4BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test7:*:*:*:*:*:*:*",
"matchCriteriaId": "F73290B2-384B-4B0F-8763-EF4D5D7C39FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test8:*:*:*:*:*:*:*",
"matchCriteriaId": "4728B3CD-5B54-4B0B-8967-DE7D9E1474F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test9:*:*:*:*:*:*:*",
"matchCriteriaId": "F353B495-D69A-4831-9E5B-F15F8F749C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test10:*:*:*:*:*:*:*",
"matchCriteriaId": "16647409-3ADD-4E86-A053-4A7B8365700E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5CA9F6-68FE-4412-8CD5-F85E970249F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test12:*:*:*:*:*:*:*",
"matchCriteriaId": "74A74354-1EAB-4A4F-A79C-C04E9BCDF594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test14:*:*:*:*:*:*:*",
"matchCriteriaId": "03A016A3-CAA9-4FCB-B909-F4163CE1E19E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test15:*:*:*:*:*:*:*",
"matchCriteriaId": "82A53B7C-8E9D-4DD6-8B00-628F7796A365",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test16:*:*:*:*:*:*:*",
"matchCriteriaId": "3D5AADA5-05DA-4660-9636-A3B737916A0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test17:*:*:*:*:*:*:*",
"matchCriteriaId": "2778FEDE-063B-4454-9FA7-F526334CF9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test18:*:*:*:*:*:*:*",
"matchCriteriaId": "989D471D-3F81-4018-A124-7FBEB3F4AB87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test19:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EA97AE-B2DD-40F8-81E1-467E895CE736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test20:*:*:*:*:*:*:*",
"matchCriteriaId": "F0C82A6A-4548-4508-B337-1061E57D78AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test21:*:*:*:*:*:*:*",
"matchCriteriaId": "36A972BC-6956-4195-933C-F3694BFEFB50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test22:*:*:*:*:*:*:*",
"matchCriteriaId": "E9EF5187-C008-4927-B5CB-A491768E9822",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test23:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A39ECE-7C8D-4BB8-A408-08EA0879F03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test24:*:*:*:*:*:*:*",
"matchCriteriaId": "6C67474C-3274-4F62-AF98-6953F9744522",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test26:*:*:*:*:*:*:*",
"matchCriteriaId": "D799CAF5-BFC3-4A80-8AE2-D292B7F9D9CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test27:*:*:*:*:*:*:*",
"matchCriteriaId": "98D3B905-FCD7-4136-A94C-76A95994CD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test29:*:*:*:*:*:*:*",
"matchCriteriaId": "1AE172A1-D9A5-4FF7-B316-4E0BD639B35D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.0.1, when running in \"dev tap\" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses."
}
],
"id": "CVE-2005-2533",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-08-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-12-03 18:59
Modified
2025-04-12 10:46
Severity ?
Summary
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://advisories.mageia.org/MGASA-2014-0512.html | Third Party Advisory | |
| secalert@redhat.com | http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html | Third Party Advisory | |
| secalert@redhat.com | http://www.debian.org/security/2014/dsa-3084 | Third Party Advisory | |
| secalert@redhat.com | http://www.mandriva.com/security/advisories?name=MDVSA-2015:139 | Broken Link | |
| secalert@redhat.com | http://www.ubuntu.com/usn/USN-2430-1 | Third Party Advisory | |
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://advisories.mageia.org/MGASA-2014-0512.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2014/dsa-3084 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDVSA-2015:139 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-2430-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mageia | mageia | 4.0 | |
| debian | debian_linux | 7.0 | |
| debian | debian_linux | 8.0 | |
| opensuse | opensuse | 12.3 | |
| opensuse | opensuse | 13.1 | |
| opensuse | opensuse | 13.2 | |
| openvpn | openvpn | 2.0.1_rc1 | |
| openvpn | openvpn | 2.0.1_rc2 | |
| openvpn | openvpn | 2.0.1_rc3 | |
| openvpn | openvpn | 2.0.1_rc4 | |
| openvpn | openvpn | 2.0.1_rc5 | |
| openvpn | openvpn | 2.0.1_rc6 | |
| openvpn | openvpn | 2.0.1_rc7 | |
| openvpn | openvpn | 2.0.2_rc1 | |
| openvpn | openvpn | 2.0.3_rc1 | |
| openvpn | openvpn | 2.0.4 | |
| openvpn | openvpn | 2.0.6_rc1 | |
| openvpn | openvpn | 2.0.9 | |
| openvpn | openvpn | 2.0_rc1 | |
| openvpn | openvpn | 2.0_rc2 | |
| openvpn | openvpn | 2.0_rc3 | |
| openvpn | openvpn | 2.0_rc4 | |
| openvpn | openvpn | 2.0_rc5 | |
| openvpn | openvpn | 2.0_rc6 | |
| openvpn | openvpn | 2.0_rc7 | |
| openvpn | openvpn | 2.0_rc8 | |
| openvpn | openvpn | 2.0_rc9 | |
| openvpn | openvpn | 2.0_rc10 | |
| openvpn | openvpn | 2.0_rc11 | |
| openvpn | openvpn | 2.0_rc12 | |
| openvpn | openvpn | 2.0_rc13 | |
| openvpn | openvpn | 2.0_rc14 | |
| openvpn | openvpn | 2.0_rc15 | |
| openvpn | openvpn | 2.0_rc16 | |
| openvpn | openvpn | 2.0_rc17 | |
| openvpn | openvpn | 2.0_rc18 | |
| openvpn | openvpn | 2.0_rc19 | |
| openvpn | openvpn | 2.0_rc20 | |
| openvpn | openvpn | 2.0_rc21 | |
| openvpn | openvpn | 2.0_test1 | |
| openvpn | openvpn | 2.0_test2 | |
| openvpn | openvpn | 2.0_test3 | |
| openvpn | openvpn | 2.0_test4 | |
| openvpn | openvpn | 2.0_test5 | |
| openvpn | openvpn | 2.0_test6 | |
| openvpn | openvpn | 2.0_test7 | |
| openvpn | openvpn | 2.0_test8 | |
| openvpn | openvpn | 2.0_test9 | |
| openvpn | openvpn | 2.0_test10 | |
| openvpn | openvpn | 2.0_test11 | |
| openvpn | openvpn | 2.0_test12 | |
| openvpn | openvpn | 2.0_test14 | |
| openvpn | openvpn | 2.0_test15 | |
| openvpn | openvpn | 2.0_test16 | |
| openvpn | openvpn | 2.0_test17 | |
| openvpn | openvpn | 2.0_test18 | |
| openvpn | openvpn | 2.0_test19 | |
| openvpn | openvpn | 2.0_test20 | |
| openvpn | openvpn | 2.0_test21 | |
| openvpn | openvpn | 2.0_test22 | |
| openvpn | openvpn | 2.0_test23 | |
| openvpn | openvpn | 2.0_test24 | |
| openvpn | openvpn | 2.0_test25 | |
| openvpn | openvpn | 2.0_test26 | |
| openvpn | openvpn | 2.0_test27 | |
| openvpn | openvpn | 2.0_test28 | |
| openvpn | openvpn | 2.0_test29 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1 | |
| openvpn | openvpn | 2.1.0 | |
| openvpn | openvpn | 2.1.1 | |
| openvpn | openvpn | 2.1.2 | |
| openvpn | openvpn | 2.1.3 | |
| openvpn | openvpn | 2.1.4 | |
| openvpn | openvpn | 2.2 | |
| openvpn | openvpn | 2.2 | |
| openvpn | openvpn | 2.2 | |
| openvpn | openvpn | 2.2 | |
| openvpn | openvpn | 2.2 | |
| openvpn | openvpn | 2.2.0 | |
| openvpn | openvpn | 2.2.1 | |
| openvpn | openvpn | 2.2.2 | |
| openvpn | openvpn | 2.3 | |
| openvpn | openvpn | 2.3 | |
| openvpn | openvpn | 2.3 | |
| openvpn | openvpn | 2.3 | |
| openvpn | openvpn | 2.3 | |
| openvpn | openvpn | 2.3 | |
| openvpn | openvpn | 2.3.0 | |
| openvpn | openvpn | 2.3.1 | |
| openvpn | openvpn | 2.3.2 | |
| openvpn | openvpn | 2.3.3 | |
| openvpn | openvpn | 2.3.4 | |
| openvpn | openvpn | 2.3.5 | |
| openvpn | openvpn_access_server | 2.0.0 | |
| openvpn | openvpn_access_server | 2.0.1 | |
| openvpn | openvpn_access_server | 2.0.2 | |
| openvpn | openvpn_access_server | 2.0.3 | |
| openvpn | openvpn_access_server | 2.0.5 | |
| openvpn | openvpn_access_server | 2.0.6 | |
| openvpn | openvpn_access_server | 2.0.7 | |
| openvpn | openvpn_access_server | 2.0.8 | |
| openvpn | openvpn_access_server | 2.0.10 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 14.04 | |
| canonical | ubuntu_linux | 14.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F805A106-9A6F-48E7-8582-D3C5A26DFC11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8D0ECEAF-401A-434E-9B0A-1A234BAEFC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "E751FA0E-0DF4-4F81-912A-1A132640246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "43F61AC6-EDF6-4818-BA51-3EAA299680B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "D32984D8-9631-407B-834E-303B9405A425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB44A872-3FE2-47E9-BA84-B6E1015E1973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "F020080D-7181-400D-988E-6844D1653464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "86D08038-9815-4222-9CD3-1211FE5954A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CE43EA96-5B3C-498F-A040-C800821DA49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.3_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "236F2BBF-0CF5-465E-9E65-8AD6D17F57A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8DF6B1F4-6313-4BF4-AD87-431A1C9D40C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA031086-95E4-4447-A06B-3B2926E3265F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "FD8ABC0A-80F7-4B7A-9D0A-015C53D1A1B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0A6E23-6456-4305-A7DA-8CA1D506D4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "D985B9F0-5B4F-4120-8ECF-506C5F6179FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "CF7E6096-58BF-47F1-982B-27A9ED735AEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "62362541-FE20-47ED-9E03-94216A3D43CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BD7019-BBA5-4D08-85C8-571D2EC03FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1D56A4-A03C-445C-993B-1AA12024D4FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "F563B1FD-FC1F-4304-8141-A1188A190835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc8:*:*:*:*:*:*:*",
"matchCriteriaId": "4269ED1A-3031-4572-B134-62C6E533D176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc9:*:*:*:*:*:*:*",
"matchCriteriaId": "140999A7-E9BB-4459-B3F8-48DF8F5DFE0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc10:*:*:*:*:*:*:*",
"matchCriteriaId": "41CD75B0-24D0-40BA-A4FB-925BD5414298",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc11:*:*:*:*:*:*:*",
"matchCriteriaId": "DED8F3C5-8E43-4B07-8224-38BF4774F4CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc12:*:*:*:*:*:*:*",
"matchCriteriaId": "3EC88614-E782-447B-B854-955498FAAA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc13:*:*:*:*:*:*:*",
"matchCriteriaId": "D2C1B8EE-3C12-452F-986E-6FD8A230685A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc14:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AC6851-F63E-47D7-BDEF-3BFF39E94D9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc15:*:*:*:*:*:*:*",
"matchCriteriaId": "685F5555-793D-4FAA-8CF4-578490CFAC6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc16:*:*:*:*:*:*:*",
"matchCriteriaId": "E688CF0C-134B-49E2-AEB3-45ECACB8B5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc17:*:*:*:*:*:*:*",
"matchCriteriaId": "1D385327-D1FF-4A22-A0C0-0C5AA53590C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc18:*:*:*:*:*:*:*",
"matchCriteriaId": "51329755-1DBF-40E1-960C-E924CDC4B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc19:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE65AC5-C218-456F-86FB-1C8BEC3C4598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc20:*:*:*:*:*:*:*",
"matchCriteriaId": "1412133F-3B44-43B6-A4FF-FF80E7B564E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc21:*:*:*:*:*:*:*",
"matchCriteriaId": "B55EE355-28A1-4955-9ADD-A8E02376C9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test1:*:*:*:*:*:*:*",
"matchCriteriaId": "E942C13E-6B54-465F-8026-ED49BD7EA2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test2:*:*:*:*:*:*:*",
"matchCriteriaId": "AADF30CF-AD36-45EB-AF50-EB0533B20B70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD078F82-361C-4B38-86E8-85E129F41A36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test4:*:*:*:*:*:*:*",
"matchCriteriaId": "09ADBC1B-7835-4D63-AA86-EF056E008F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9831C92-7717-4650-8689-3C41B773C5CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test6:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3521E7-572E-4ADD-AAF6-F1AE505B4BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test7:*:*:*:*:*:*:*",
"matchCriteriaId": "F73290B2-384B-4B0F-8763-EF4D5D7C39FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test8:*:*:*:*:*:*:*",
"matchCriteriaId": "4728B3CD-5B54-4B0B-8967-DE7D9E1474F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test9:*:*:*:*:*:*:*",
"matchCriteriaId": "F353B495-D69A-4831-9E5B-F15F8F749C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test10:*:*:*:*:*:*:*",
"matchCriteriaId": "16647409-3ADD-4E86-A053-4A7B8365700E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5CA9F6-68FE-4412-8CD5-F85E970249F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test12:*:*:*:*:*:*:*",
"matchCriteriaId": "74A74354-1EAB-4A4F-A79C-C04E9BCDF594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test14:*:*:*:*:*:*:*",
"matchCriteriaId": "03A016A3-CAA9-4FCB-B909-F4163CE1E19E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test15:*:*:*:*:*:*:*",
"matchCriteriaId": "82A53B7C-8E9D-4DD6-8B00-628F7796A365",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test16:*:*:*:*:*:*:*",
"matchCriteriaId": "3D5AADA5-05DA-4660-9636-A3B737916A0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test17:*:*:*:*:*:*:*",
"matchCriteriaId": "2778FEDE-063B-4454-9FA7-F526334CF9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test18:*:*:*:*:*:*:*",
"matchCriteriaId": "989D471D-3F81-4018-A124-7FBEB3F4AB87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test19:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EA97AE-B2DD-40F8-81E1-467E895CE736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test20:*:*:*:*:*:*:*",
"matchCriteriaId": "F0C82A6A-4548-4508-B337-1061E57D78AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test21:*:*:*:*:*:*:*",
"matchCriteriaId": "36A972BC-6956-4195-933C-F3694BFEFB50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test22:*:*:*:*:*:*:*",
"matchCriteriaId": "E9EF5187-C008-4927-B5CB-A491768E9822",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test23:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A39ECE-7C8D-4BB8-A408-08EA0879F03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test24:*:*:*:*:*:*:*",
"matchCriteriaId": "6C67474C-3274-4F62-AF98-6953F9744522",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test25:*:*:*:*:*:*:*",
"matchCriteriaId": "5196B669-CF0F-4FED-9EAF-72F335436BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test26:*:*:*:*:*:*:*",
"matchCriteriaId": "D799CAF5-BFC3-4A80-8AE2-D292B7F9D9CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test27:*:*:*:*:*:*:*",
"matchCriteriaId": "98D3B905-FCD7-4136-A94C-76A95994CD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test28:*:*:*:*:*:*:*",
"matchCriteriaId": "F696A07E-ECE3-4010-A908-A006C85EECCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test29:*:*:*:*:*:*:*",
"matchCriteriaId": "1AE172A1-D9A5-4FF7-B316-4E0BD639B35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-1:*:*:*:*:*:*",
"matchCriteriaId": "8459B597-7229-446D-905D-B1528AE72A48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-10:*:*:*:*:*:*",
"matchCriteriaId": "70873B7B-C431-4D21-81FE-C5DB695E51A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-11:*:*:*:*:*:*",
"matchCriteriaId": "6841F4A3-DFF8-48A7-A88B-52C71DB19096",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-12:*:*:*:*:*:*",
"matchCriteriaId": "DBAECB05-74F1-410E-B2D4-6B789D275BFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-13:*:*:*:*:*:*",
"matchCriteriaId": "D1BCCE52-CFC5-4EED-8A1F-12649A1F0ED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-14:*:*:*:*:*:*",
"matchCriteriaId": "C6826F2C-9769-4F70-8121-988986C9DAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-15:*:*:*:*:*:*",
"matchCriteriaId": "38CDC26A-2EA1-4FD1-BE82-09ABE335A778",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-16:*:*:*:*:*:*",
"matchCriteriaId": "F4284CC6-B78D-478D-B815-3FB4D884A726",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-2:*:*:*:*:*:*",
"matchCriteriaId": "453245EF-965E-4F93-83D3-48B90FE48A6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-3:*:*:*:*:*:*",
"matchCriteriaId": "EF5EC30A-3DC5-4E7A-836C-8664F716416C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-4:*:*:*:*:*:*",
"matchCriteriaId": "2678B55D-319C-43F6-B728-7A321D4B3209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-5:*:*:*:*:*:*",
"matchCriteriaId": "E35E44F6-BEBB-4042-83D2-A7EA0973741D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-6:*:*:*:*:*:*",
"matchCriteriaId": "FAE85542-1693-4DC6-9948-7255E4773BA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-7:*:*:*:*:*:*",
"matchCriteriaId": "7D1C661A-5BD4-4BC3-88E8-31412B8160F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-8:*:*:*:*:*:*",
"matchCriteriaId": "2EEF3348-775A-4DE0-AAF0-482B91A3AC40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-9:*:*:*:*:*:*",
"matchCriteriaId": "82269255-618E-43DC-9486-B17A790844F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_1:*:*:*:*:*:*",
"matchCriteriaId": "F972B6E6-0553-454E-BF58-107E7A9EC9E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_10:*:*:*:*:*:*",
"matchCriteriaId": "973BB008-9779-4F7F-8759-1266430EE01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_11:*:*:*:*:*:*",
"matchCriteriaId": "5DC24D46-CD48-480E-862E-AF2E4D6BEECB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_12:*:*:*:*:*:*",
"matchCriteriaId": "AD17C1C3-73FF-4B96-8E90-73D64A59A02F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_13:*:*:*:*:*:*",
"matchCriteriaId": "86DCBDE1-C3D8-4E1A-85B1-E82D4957434A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_14:*:*:*:*:*:*",
"matchCriteriaId": "1A939316-AAB3-4731-9CBF-C4FB103EF69C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_15:*:*:*:*:*:*",
"matchCriteriaId": "97EEF414-D6EF-4DA4-809A-CC4D795EC4C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_16:*:*:*:*:*:*",
"matchCriteriaId": "C7E98A8B-D506-46EB-A013-6E992245BB06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_17:*:*:*:*:*:*",
"matchCriteriaId": "062BBC75-316A-4A75-B013-C65575BA1879",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_18:*:*:*:*:*:*",
"matchCriteriaId": "21364ECB-DBA6-4222-8138-7367971621B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_19:*:*:*:*:*:*",
"matchCriteriaId": "A72074A1-9296-40AE-A456-97FEA13B1FC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_2:*:*:*:*:*:*",
"matchCriteriaId": "9DBF4843-5E4F-4C47-BBF8-4ADB45C422E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_20:*:*:*:*:*:*",
"matchCriteriaId": "736E4AF6-126C-4521-983A-36599E658BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_21:*:*:*:*:*:*",
"matchCriteriaId": "199F38E7-44A5-47DE-AE71-E04D06B456CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_22:*:*:*:*:*:*",
"matchCriteriaId": "6495D598-AF9E-4258-A193-32712D3B4340",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_3:*:*:*:*:*:*",
"matchCriteriaId": "61BB61B4-2769-4F59-875F-9269C551E386",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_4:*:*:*:*:*:*",
"matchCriteriaId": "DBD947CF-98BC-4C84-8149-B4EEFF1015AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_5:*:*:*:*:*:*",
"matchCriteriaId": "FE621907-2D6B-4558-A9B9-E98AAF236D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_6:*:*:*:*:*:*",
"matchCriteriaId": "B57458F3-B8F9-454E-98B1-9FA33ABDF0BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_7:*:*:*:*:*:*",
"matchCriteriaId": "42F0E1FF-0863-418C-BD26-F3B18B257370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_8:*:*:*:*:*:*",
"matchCriteriaId": "B0E905D4-34F6-4ACD-8D86-0C9E29EDB282",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_9:*:*:*:*:*:*",
"matchCriteriaId": "201BAAB4-181A-45CF-8800-AEFA3AFC44DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "88C2922E-6E95-45BF-ABF1-B1D799769DB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0A74DA07-5725-46B5-BC90-B1B2A2562E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83495B90-FD8D-453B-B39E-B6630BC9E1F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D1E027B8-5D0D-4DA3-8D25-FAC2CAAE971C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B5A241E3-1F25-48C9-A49F-6F9E805E7732",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "2FD8F84B-583A-4605-B939-75E90B28AAE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2:beta2:*:*:*:*:*:*",
"matchCriteriaId": "7C996321-0770-4949-B627-EFD23CA54DED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2:beta3:*:*:*:*:*:*",
"matchCriteriaId": "0863345A-59FC-4FE9-AC18-4949B69FC8F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2:beta4:*:*:*:*:*:*",
"matchCriteriaId": "D7559EF0-C9C5-4D1A-BED3-8DC10A1FA0D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2:beta5:*:*:*:*:*:*",
"matchCriteriaId": "7557FBEB-9F01-482A-BD92-E4636216B278",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1D915A07-3B93-4D7C-8D52-73B696392B46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1E75645E-829A-414B-9758-33E68C397D07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FB4ED809-BBE7-4D82-BBB8-CF47134B676B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "2CAF2208-8204-4747-BCD7-0640E8D37DF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "C52337EC-B6F2-4D24-946B-2BC0F7AB289B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3:alpha3:*:*:*:*:*:*",
"matchCriteriaId": "7ECE3870-15C5-444D-8791-C95E3154B6F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "73308E91-F884-41BF-8B6F-D5ECA69BC622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EEE9B244-7B5D-4089-8DF9-4618340EB09C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A3CF7B64-4C8E-482A-8D54-9033234322E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A0001EA6-8B77-474F-AB96-B64BE06F9071",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "311B464F-A8B0-4258-86E5-05CBE0CBCACF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "77D50828-4D5C-4EDD-960E-C59F13ED64A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D15C3021-8F17-4869-ACFB-E567000ECE7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "68F52EAE-E3B5-4186-A11C-A481F54B79C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FF9F2DF9-3E2B-4B31-8735-334EECB6F6A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "486CD3E2-1B1A-4A1D-98ED-0E2EEAB0A0CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B42CB75B-355B-4D80-91EA-77723B275D0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E5EFEC7-D9B6-454A-A36A-C75874564FCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "21846206-4CF3-426F-9BE7-93471987BC06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4ED93D78-3BA8-43DB-B5AF-D2D3941C9DAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C2B16482-8058-46A8-9D56-DB73BFE32A1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "F105F380-57BF-44BD-B31D-9D36DF9210A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C802FAF2-EAB3-4C79-B1D1-D27C8D5CEE63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "BF722539-0A07-4C74-85F0-342195714D2B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
"matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet."
},
{
"lang": "es",
"value": "OpenVPN 2.x anterior a 2.0.11, 2.1.x, 2.2.x anterior a 2.2.3, y 2.3.x anterior a 2.3.6 permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (ca\u00edda del servidor) a trav\u00e9s de un paquete de canal de control peque\u00f1o."
}
],
"id": "CVE-2014-8104",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-12-03T18:59:00.063",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0512.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2014/dsa-3084"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:139"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2430-1"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0512.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2014/dsa-3084"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2430-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-10-04 01:29
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.securityfocus.com/bid/101153 | Third Party Advisory, VDB Entry, URL Repurposed | |
| secalert@redhat.com | http://www.securitytracker.com/id/1039470 | Third Party Advisory, VDB Entry, URL Repurposed | |
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 | Patch, Vendor Advisory | |
| secalert@redhat.com | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/101153 | Third Party Advisory, VDB Entry, URL Repurposed | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1039470 | Third Party Advisory, VDB Entry, URL Repurposed | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C5DD8899-640F-42F3-A82F-ACC4D2529C95",
"versionEndExcluding": "2.3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC52F79-A9F0-45FE-9EC0-58E970E4B3B1",
"versionEndExcluding": "2.4.4",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution."
},
{
"lang": "es",
"value": "OpenVPN en versiones anteriores a la 2.3.3 y en versiones 2.4.x anteriores a la 2.4.4 es vulnerable a undesbordamiento de b\u00fafer cuando se utiliza key-method 1, lo que puede provocar la ejecuci\u00f3n de c\u00f3digo."
}
],
"id": "CVE-2017-12166",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-10-04T01:29:02.090",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry",
"URL Repurposed"
],
"url": "http://www.securityfocus.com/bid/101153"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry",
"URL Repurposed"
],
"url": "http://www.securitytracker.com/id/1039470"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2017-12166"
},
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry",
"URL Repurposed"
],
"url": "http://www.securityfocus.com/bid/101153"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry",
"URL Repurposed"
],
"url": "http://www.securitytracker.com/id/1039470"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2017-12166"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-04-06 22:04
Modified
2025-04-03 01:03
Severity ?
Summary
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openvpn.net/changelog.html | Patch | |
| cve@mitre.org | http://secunia.com/advisories/19531 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/19598 | ||
| cve@mitre.org | http://secunia.com/advisories/19837 | ||
| cve@mitre.org | http://secunia.com/advisories/19897 | ||
| cve@mitre.org | http://sourceforge.net/mailarchive/forum.php?thread_id=10093825&forum_id=8482 | ||
| cve@mitre.org | http://www.debian.org/security/2006/dsa-1045 | ||
| cve@mitre.org | http://www.mandriva.com/security/advisories?name=MDKSA-2006:069 | ||
| cve@mitre.org | http://www.novell.com/linux/security/advisories/2006_04_28.html | ||
| cve@mitre.org | http://www.osreviews.net/reviews/security/openvpn-print | ||
| cve@mitre.org | http://www.osvdb.org/24444 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/17392 | Patch | |
| cve@mitre.org | http://www.vupen.com/english/advisories/2006/1261 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/25667 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/changelog.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/19531 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/19598 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/19837 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/19897 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://sourceforge.net/mailarchive/forum.php?thread_id=10093825&forum_id=8482 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2006/dsa-1045 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDKSA-2006:069 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.novell.com/linux/security/advisories/2006_04_28.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osreviews.net/reviews/security/openvpn-print | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/24444 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/17392 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2006/1261 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/25667 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0.4 | |
| openvpn | openvpn_access_server | 2.0.1 | |
| openvpn | openvpn_access_server | 2.0.2 | |
| openvpn | openvpn_access_server | 2.0.3 | |
| openvpn | openvpn_access_server | 2.0.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8DF6B1F4-6313-4BF4-AD87-431A1C9D40C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B42CB75B-355B-4D80-91EA-77723B275D0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E5EFEC7-D9B6-454A-A36A-C75874564FCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "21846206-4CF3-426F-9BE7-93471987BC06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4ED93D78-3BA8-43DB-B5AF-D2D3941C9DAD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable."
}
],
"evaluatorSolution": "OpenVPN version 2.0.6 fixes this vulnerability.",
"id": "CVE-2006-1629",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-04-06T22:04:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://openvpn.net/changelog.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19531"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/19598"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/19837"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "cve@mitre.org",
"url": "http://sourceforge.net/mailarchive/forum.php?thread_id=10093825\u0026forum_id=8482"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2006/dsa-1045"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:069"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osreviews.net/reviews/security/openvpn-print"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/24444"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17392"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1261"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openvpn.net/changelog.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19531"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/19598"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/19837"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/mailarchive/forum.php?thread_id=10093825\u0026forum_id=8482"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2006/dsa-1045"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:069"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osreviews.net/reviews/security/openvpn-print"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/24444"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17392"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1261"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25667"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-06-27 13:29
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.debian.org/security/2017/dsa-3900 | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| secalert@redhat.com | http://www.securitytracker.com/id/1038768 | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2017/dsa-3900 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1038768 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "216840B9-FCDB-4921-BE12-2A1FA42F8FDE",
"versionEndIncluding": "2.3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84F5C67A-34A4-4C7E-BCA9-AF3E5FC70AF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "A857CA88-60B0-4D34-87B6-770B67981501",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B42297EE-B347-4BD8-A657-BDF0AA010C06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "7C7A56E8-09C8-4DB2-9244-9E5E2BEC1821",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "41ACD637-EF6B-40E4-BDE6-0EE7D6AEBAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1A4150AD-3F46-487D-BCF8-79D0AE2A092D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E7F7663E-3EB5-44F4-B7DE-294A549A12BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "81434C3E-F992-4F29-9092-6823989B6909",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension()."
},
{
"lang": "es",
"value": "Las versiones de OpenVPN anteriores a 2.4.3 y 2.3.17, son vulnerables a una denegaci\u00f3n de servicio remota debido a un agotamiento de memoria causado por p\u00e9rdida de memoria y un problema de doble liberaci\u00f3n (Double Free) en la funci\u00f3n extract_x509_extension()."
}
],
"id": "CVE-2017-7521",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-06-27T13:29:00.240",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-415"
},
{
"lang": "en",
"value": "CWE-772"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-08-24 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openvpn.net/changelog.html | ||
| cve@mitre.org | http://secunia.com/advisories/16463 | ||
| cve@mitre.org | http://secunia.com/advisories/17103 | ||
| cve@mitre.org | http://www.debian.org/security/2005/dsa-851 | ||
| cve@mitre.org | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/14610 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/changelog.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/16463 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17103 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2005/dsa-851 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/14610 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0.1_rc1 | |
| openvpn | openvpn | 2.0.1_rc2 | |
| openvpn | openvpn | 2.0.1_rc3 | |
| openvpn | openvpn | 2.0.1_rc4 | |
| openvpn | openvpn | 2.0.1_rc5 | |
| openvpn | openvpn | 2.0.1_rc6 | |
| openvpn | openvpn | 2.0.1_rc7 | |
| openvpn | openvpn | 2.0_beta1 | |
| openvpn | openvpn | 2.0_beta2 | |
| openvpn | openvpn | 2.0_beta3 | |
| openvpn | openvpn | 2.0_beta4 | |
| openvpn | openvpn | 2.0_beta5 | |
| openvpn | openvpn | 2.0_beta6 | |
| openvpn | openvpn | 2.0_beta7 | |
| openvpn | openvpn | 2.0_beta8 | |
| openvpn | openvpn | 2.0_beta9 | |
| openvpn | openvpn | 2.0_beta10 | |
| openvpn | openvpn | 2.0_beta11 | |
| openvpn | openvpn | 2.0_beta12 | |
| openvpn | openvpn | 2.0_beta13 | |
| openvpn | openvpn | 2.0_beta15 | |
| openvpn | openvpn | 2.0_beta16 | |
| openvpn | openvpn | 2.0_beta17 | |
| openvpn | openvpn | 2.0_beta18 | |
| openvpn | openvpn | 2.0_beta19 | |
| openvpn | openvpn | 2.0_beta20 | |
| openvpn | openvpn | 2.0_beta28 | |
| openvpn | openvpn | 2.0_rc1 | |
| openvpn | openvpn | 2.0_rc2 | |
| openvpn | openvpn | 2.0_rc3 | |
| openvpn | openvpn | 2.0_rc4 | |
| openvpn | openvpn | 2.0_rc5 | |
| openvpn | openvpn | 2.0_rc6 | |
| openvpn | openvpn | 2.0_rc7 | |
| openvpn | openvpn | 2.0_rc8 | |
| openvpn | openvpn | 2.0_rc9 | |
| openvpn | openvpn | 2.0_rc10 | |
| openvpn | openvpn | 2.0_rc11 | |
| openvpn | openvpn | 2.0_rc12 | |
| openvpn | openvpn | 2.0_rc13 | |
| openvpn | openvpn | 2.0_rc14 | |
| openvpn | openvpn | 2.0_rc15 | |
| openvpn | openvpn | 2.0_rc16 | |
| openvpn | openvpn | 2.0_rc17 | |
| openvpn | openvpn | 2.0_rc18 | |
| openvpn | openvpn | 2.0_rc19 | |
| openvpn | openvpn | 2.0_rc20 | |
| openvpn | openvpn | 2.0_rc21 | |
| openvpn | openvpn | 2.0_test1 | |
| openvpn | openvpn | 2.0_test2 | |
| openvpn | openvpn | 2.0_test3 | |
| openvpn | openvpn | 2.0_test5 | |
| openvpn | openvpn | 2.0_test6 | |
| openvpn | openvpn | 2.0_test7 | |
| openvpn | openvpn | 2.0_test8 | |
| openvpn | openvpn | 2.0_test9 | |
| openvpn | openvpn | 2.0_test10 | |
| openvpn | openvpn | 2.0_test11 | |
| openvpn | openvpn | 2.0_test12 | |
| openvpn | openvpn | 2.0_test14 | |
| openvpn | openvpn | 2.0_test15 | |
| openvpn | openvpn | 2.0_test16 | |
| openvpn | openvpn | 2.0_test17 | |
| openvpn | openvpn | 2.0_test18 | |
| openvpn | openvpn | 2.0_test19 | |
| openvpn | openvpn | 2.0_test20 | |
| openvpn | openvpn | 2.0_test21 | |
| openvpn | openvpn | 2.0_test22 | |
| openvpn | openvpn | 2.0_test23 | |
| openvpn | openvpn | 2.0_test24 | |
| openvpn | openvpn | 2.0_test26 | |
| openvpn | openvpn | 2.0_test27 | |
| openvpn | openvpn | 2.0_test29 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8D0ECEAF-401A-434E-9B0A-1A234BAEFC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "E751FA0E-0DF4-4F81-912A-1A132640246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "43F61AC6-EDF6-4818-BA51-3EAA299680B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "D32984D8-9631-407B-834E-303B9405A425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB44A872-3FE2-47E9-BA84-B6E1015E1973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "F020080D-7181-400D-988E-6844D1653464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "86D08038-9815-4222-9CD3-1211FE5954A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "2BDEBEDA-437A-4942-8A71-7B25DD558BCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EB8A78E-DAB9-4A72-BC54-58230E1E9B9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta3:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D74ED1-34C5-4F95-A941-83664AFFF2ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta4:*:*:*:*:*:*:*",
"matchCriteriaId": "0747C1A9-C404-4FBD-AA8F-9DBB70FEB4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta5:*:*:*:*:*:*:*",
"matchCriteriaId": "5A3B1AD4-9EA0-4D86-90E1-3366FBC5629D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta6:*:*:*:*:*:*:*",
"matchCriteriaId": "8E483BD0-CAB9-4DA0-AAA4-A934B8318FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F04FAB1-A558-4F93-9FBF-043DE259A813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta8:*:*:*:*:*:*:*",
"matchCriteriaId": "A189A733-3130-41B4-94DD-E99E294D0FBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta9:*:*:*:*:*:*:*",
"matchCriteriaId": "7DEE5695-DC49-445D-864A-4739E16DF762",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta10:*:*:*:*:*:*:*",
"matchCriteriaId": "6FBF146F-2CFA-4F14-BFBC-E01B58F9F72B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5D263CA-8B2C-4B66-8990-6224BAF52A8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta12:*:*:*:*:*:*:*",
"matchCriteriaId": "825C9FCE-AD76-4E32-8FEC-EEFA0662BC04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta13:*:*:*:*:*:*:*",
"matchCriteriaId": "2C7519FA-831A-41D7-AFC3-B9457E6DFB4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta15:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB79AFD-493F-41F1-9EC1-8BCC0D28A914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta16:*:*:*:*:*:*:*",
"matchCriteriaId": "2C8F091B-194A-4FC5-87F4-A76CB490F3F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta17:*:*:*:*:*:*:*",
"matchCriteriaId": "11716B49-A920-4A1B-BEA5-4105213B9731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta18:*:*:*:*:*:*:*",
"matchCriteriaId": "756A7AF5-E502-4EDC-9693-4041C993E3BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta19:*:*:*:*:*:*:*",
"matchCriteriaId": "9885BC3E-1854-4561-9906-FFAEECA5B6FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta20:*:*:*:*:*:*:*",
"matchCriteriaId": "D7B7759F-F228-436D-BC86-7317B0109C02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta28:*:*:*:*:*:*:*",
"matchCriteriaId": "ADB9BD19-1BF9-42D0-9E43-7D95EE010347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0A6E23-6456-4305-A7DA-8CA1D506D4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "D985B9F0-5B4F-4120-8ECF-506C5F6179FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "CF7E6096-58BF-47F1-982B-27A9ED735AEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "62362541-FE20-47ED-9E03-94216A3D43CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BD7019-BBA5-4D08-85C8-571D2EC03FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1D56A4-A03C-445C-993B-1AA12024D4FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "F563B1FD-FC1F-4304-8141-A1188A190835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc8:*:*:*:*:*:*:*",
"matchCriteriaId": "4269ED1A-3031-4572-B134-62C6E533D176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc9:*:*:*:*:*:*:*",
"matchCriteriaId": "140999A7-E9BB-4459-B3F8-48DF8F5DFE0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc10:*:*:*:*:*:*:*",
"matchCriteriaId": "41CD75B0-24D0-40BA-A4FB-925BD5414298",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc11:*:*:*:*:*:*:*",
"matchCriteriaId": "DED8F3C5-8E43-4B07-8224-38BF4774F4CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc12:*:*:*:*:*:*:*",
"matchCriteriaId": "3EC88614-E782-447B-B854-955498FAAA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc13:*:*:*:*:*:*:*",
"matchCriteriaId": "D2C1B8EE-3C12-452F-986E-6FD8A230685A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc14:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AC6851-F63E-47D7-BDEF-3BFF39E94D9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc15:*:*:*:*:*:*:*",
"matchCriteriaId": "685F5555-793D-4FAA-8CF4-578490CFAC6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc16:*:*:*:*:*:*:*",
"matchCriteriaId": "E688CF0C-134B-49E2-AEB3-45ECACB8B5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc17:*:*:*:*:*:*:*",
"matchCriteriaId": "1D385327-D1FF-4A22-A0C0-0C5AA53590C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc18:*:*:*:*:*:*:*",
"matchCriteriaId": "51329755-1DBF-40E1-960C-E924CDC4B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc19:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE65AC5-C218-456F-86FB-1C8BEC3C4598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc20:*:*:*:*:*:*:*",
"matchCriteriaId": "1412133F-3B44-43B6-A4FF-FF80E7B564E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc21:*:*:*:*:*:*:*",
"matchCriteriaId": "B55EE355-28A1-4955-9ADD-A8E02376C9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test1:*:*:*:*:*:*:*",
"matchCriteriaId": "E942C13E-6B54-465F-8026-ED49BD7EA2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test2:*:*:*:*:*:*:*",
"matchCriteriaId": "AADF30CF-AD36-45EB-AF50-EB0533B20B70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD078F82-361C-4B38-86E8-85E129F41A36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9831C92-7717-4650-8689-3C41B773C5CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test6:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3521E7-572E-4ADD-AAF6-F1AE505B4BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test7:*:*:*:*:*:*:*",
"matchCriteriaId": "F73290B2-384B-4B0F-8763-EF4D5D7C39FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test8:*:*:*:*:*:*:*",
"matchCriteriaId": "4728B3CD-5B54-4B0B-8967-DE7D9E1474F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test9:*:*:*:*:*:*:*",
"matchCriteriaId": "F353B495-D69A-4831-9E5B-F15F8F749C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test10:*:*:*:*:*:*:*",
"matchCriteriaId": "16647409-3ADD-4E86-A053-4A7B8365700E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5CA9F6-68FE-4412-8CD5-F85E970249F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test12:*:*:*:*:*:*:*",
"matchCriteriaId": "74A74354-1EAB-4A4F-A79C-C04E9BCDF594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test14:*:*:*:*:*:*:*",
"matchCriteriaId": "03A016A3-CAA9-4FCB-B909-F4163CE1E19E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test15:*:*:*:*:*:*:*",
"matchCriteriaId": "82A53B7C-8E9D-4DD6-8B00-628F7796A365",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test16:*:*:*:*:*:*:*",
"matchCriteriaId": "3D5AADA5-05DA-4660-9636-A3B737916A0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test17:*:*:*:*:*:*:*",
"matchCriteriaId": "2778FEDE-063B-4454-9FA7-F526334CF9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test18:*:*:*:*:*:*:*",
"matchCriteriaId": "989D471D-3F81-4018-A124-7FBEB3F4AB87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test19:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EA97AE-B2DD-40F8-81E1-467E895CE736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test20:*:*:*:*:*:*:*",
"matchCriteriaId": "F0C82A6A-4548-4508-B337-1061E57D78AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test21:*:*:*:*:*:*:*",
"matchCriteriaId": "36A972BC-6956-4195-933C-F3694BFEFB50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test22:*:*:*:*:*:*:*",
"matchCriteriaId": "E9EF5187-C008-4927-B5CB-A491768E9822",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test23:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A39ECE-7C8D-4BB8-A408-08EA0879F03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test24:*:*:*:*:*:*:*",
"matchCriteriaId": "6C67474C-3274-4F62-AF98-6953F9744522",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test26:*:*:*:*:*:*:*",
"matchCriteriaId": "D799CAF5-BFC3-4A80-8AE2-D292B7F9D9CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test27:*:*:*:*:*:*:*",
"matchCriteriaId": "98D3B905-FCD7-4136-A94C-76A95994CD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test29:*:*:*:*:*:*:*",
"matchCriteriaId": "1AE172A1-D9A5-4FF7-B316-4E0BD639B35D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate."
}
],
"id": "CVE-2005-2534",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-08-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/14610"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/14610"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-12 11:15
Modified
2024-11-21 06:21
Severity ?
Summary
OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2021-3547 | Patch, Vendor Advisory | |
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2021-3547 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2003E88A-EC3B-48F8-9E89-78CF2BBFFA4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:3.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EEE05E9D-DFA1-4EEC-9530-3C5EBFA68F7C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration."
},
{
"lang": "es",
"value": "OpenVPN 3 Core Library versiones 3.6 y 3.6.1, permiten a un atacante tipo \"man-in-the-middle\" omitir la autenticaci\u00f3n de certificados al emitir un certificado de servidor no relacionado usando el mismo nombre de host encontrado en la opci\u00f3n verify-x509-name en la configuraci\u00f3n de un cliente"
}
],
"id": "CVE-2021-3547",
"lastModified": "2024-11-21T06:21:48.747",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-12T11:15:08.233",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3547"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3547"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-305"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-295"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-08-24 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openvpn.net/changelog.html | ||
| cve@mitre.org | http://secunia.com/advisories/16463 | ||
| cve@mitre.org | http://secunia.com/advisories/17103 | ||
| cve@mitre.org | http://www.debian.org/security/2005/dsa-851 | ||
| cve@mitre.org | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/14607 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/changelog.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/16463 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17103 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2005/dsa-851 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/14607 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0.1_rc1 | |
| openvpn | openvpn | 2.0.1_rc2 | |
| openvpn | openvpn | 2.0.1_rc3 | |
| openvpn | openvpn | 2.0.1_rc4 | |
| openvpn | openvpn | 2.0.1_rc5 | |
| openvpn | openvpn | 2.0.1_rc6 | |
| openvpn | openvpn | 2.0.1_rc7 | |
| openvpn | openvpn | 2.0_beta1 | |
| openvpn | openvpn | 2.0_beta2 | |
| openvpn | openvpn | 2.0_beta3 | |
| openvpn | openvpn | 2.0_beta4 | |
| openvpn | openvpn | 2.0_beta5 | |
| openvpn | openvpn | 2.0_beta6 | |
| openvpn | openvpn | 2.0_beta7 | |
| openvpn | openvpn | 2.0_beta8 | |
| openvpn | openvpn | 2.0_beta9 | |
| openvpn | openvpn | 2.0_beta10 | |
| openvpn | openvpn | 2.0_beta11 | |
| openvpn | openvpn | 2.0_beta12 | |
| openvpn | openvpn | 2.0_beta13 | |
| openvpn | openvpn | 2.0_beta15 | |
| openvpn | openvpn | 2.0_beta16 | |
| openvpn | openvpn | 2.0_beta17 | |
| openvpn | openvpn | 2.0_beta18 | |
| openvpn | openvpn | 2.0_beta19 | |
| openvpn | openvpn | 2.0_beta20 | |
| openvpn | openvpn | 2.0_beta28 | |
| openvpn | openvpn | 2.0_rc1 | |
| openvpn | openvpn | 2.0_rc2 | |
| openvpn | openvpn | 2.0_rc3 | |
| openvpn | openvpn | 2.0_rc4 | |
| openvpn | openvpn | 2.0_rc5 | |
| openvpn | openvpn | 2.0_rc6 | |
| openvpn | openvpn | 2.0_rc7 | |
| openvpn | openvpn | 2.0_rc8 | |
| openvpn | openvpn | 2.0_rc9 | |
| openvpn | openvpn | 2.0_rc10 | |
| openvpn | openvpn | 2.0_rc11 | |
| openvpn | openvpn | 2.0_rc12 | |
| openvpn | openvpn | 2.0_rc13 | |
| openvpn | openvpn | 2.0_rc14 | |
| openvpn | openvpn | 2.0_rc15 | |
| openvpn | openvpn | 2.0_rc16 | |
| openvpn | openvpn | 2.0_rc17 | |
| openvpn | openvpn | 2.0_rc18 | |
| openvpn | openvpn | 2.0_rc19 | |
| openvpn | openvpn | 2.0_rc20 | |
| openvpn | openvpn | 2.0_rc21 | |
| openvpn | openvpn | 2.0_test1 | |
| openvpn | openvpn | 2.0_test2 | |
| openvpn | openvpn | 2.0_test3 | |
| openvpn | openvpn | 2.0_test5 | |
| openvpn | openvpn | 2.0_test6 | |
| openvpn | openvpn | 2.0_test7 | |
| openvpn | openvpn | 2.0_test8 | |
| openvpn | openvpn | 2.0_test9 | |
| openvpn | openvpn | 2.0_test10 | |
| openvpn | openvpn | 2.0_test11 | |
| openvpn | openvpn | 2.0_test12 | |
| openvpn | openvpn | 2.0_test14 | |
| openvpn | openvpn | 2.0_test15 | |
| openvpn | openvpn | 2.0_test16 | |
| openvpn | openvpn | 2.0_test17 | |
| openvpn | openvpn | 2.0_test18 | |
| openvpn | openvpn | 2.0_test19 | |
| openvpn | openvpn | 2.0_test20 | |
| openvpn | openvpn | 2.0_test21 | |
| openvpn | openvpn | 2.0_test22 | |
| openvpn | openvpn | 2.0_test23 | |
| openvpn | openvpn | 2.0_test24 | |
| openvpn | openvpn | 2.0_test26 | |
| openvpn | openvpn | 2.0_test27 | |
| openvpn | openvpn | 2.0_test29 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8D0ECEAF-401A-434E-9B0A-1A234BAEFC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "E751FA0E-0DF4-4F81-912A-1A132640246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "43F61AC6-EDF6-4818-BA51-3EAA299680B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "D32984D8-9631-407B-834E-303B9405A425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB44A872-3FE2-47E9-BA84-B6E1015E1973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "F020080D-7181-400D-988E-6844D1653464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "86D08038-9815-4222-9CD3-1211FE5954A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "2BDEBEDA-437A-4942-8A71-7B25DD558BCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EB8A78E-DAB9-4A72-BC54-58230E1E9B9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta3:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D74ED1-34C5-4F95-A941-83664AFFF2ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta4:*:*:*:*:*:*:*",
"matchCriteriaId": "0747C1A9-C404-4FBD-AA8F-9DBB70FEB4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta5:*:*:*:*:*:*:*",
"matchCriteriaId": "5A3B1AD4-9EA0-4D86-90E1-3366FBC5629D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta6:*:*:*:*:*:*:*",
"matchCriteriaId": "8E483BD0-CAB9-4DA0-AAA4-A934B8318FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F04FAB1-A558-4F93-9FBF-043DE259A813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta8:*:*:*:*:*:*:*",
"matchCriteriaId": "A189A733-3130-41B4-94DD-E99E294D0FBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta9:*:*:*:*:*:*:*",
"matchCriteriaId": "7DEE5695-DC49-445D-864A-4739E16DF762",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta10:*:*:*:*:*:*:*",
"matchCriteriaId": "6FBF146F-2CFA-4F14-BFBC-E01B58F9F72B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5D263CA-8B2C-4B66-8990-6224BAF52A8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta12:*:*:*:*:*:*:*",
"matchCriteriaId": "825C9FCE-AD76-4E32-8FEC-EEFA0662BC04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta13:*:*:*:*:*:*:*",
"matchCriteriaId": "2C7519FA-831A-41D7-AFC3-B9457E6DFB4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta15:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB79AFD-493F-41F1-9EC1-8BCC0D28A914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta16:*:*:*:*:*:*:*",
"matchCriteriaId": "2C8F091B-194A-4FC5-87F4-A76CB490F3F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta17:*:*:*:*:*:*:*",
"matchCriteriaId": "11716B49-A920-4A1B-BEA5-4105213B9731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta18:*:*:*:*:*:*:*",
"matchCriteriaId": "756A7AF5-E502-4EDC-9693-4041C993E3BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta19:*:*:*:*:*:*:*",
"matchCriteriaId": "9885BC3E-1854-4561-9906-FFAEECA5B6FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta20:*:*:*:*:*:*:*",
"matchCriteriaId": "D7B7759F-F228-436D-BC86-7317B0109C02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta28:*:*:*:*:*:*:*",
"matchCriteriaId": "ADB9BD19-1BF9-42D0-9E43-7D95EE010347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0A6E23-6456-4305-A7DA-8CA1D506D4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "D985B9F0-5B4F-4120-8ECF-506C5F6179FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "CF7E6096-58BF-47F1-982B-27A9ED735AEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "62362541-FE20-47ED-9E03-94216A3D43CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BD7019-BBA5-4D08-85C8-571D2EC03FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1D56A4-A03C-445C-993B-1AA12024D4FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "F563B1FD-FC1F-4304-8141-A1188A190835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc8:*:*:*:*:*:*:*",
"matchCriteriaId": "4269ED1A-3031-4572-B134-62C6E533D176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc9:*:*:*:*:*:*:*",
"matchCriteriaId": "140999A7-E9BB-4459-B3F8-48DF8F5DFE0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc10:*:*:*:*:*:*:*",
"matchCriteriaId": "41CD75B0-24D0-40BA-A4FB-925BD5414298",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc11:*:*:*:*:*:*:*",
"matchCriteriaId": "DED8F3C5-8E43-4B07-8224-38BF4774F4CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc12:*:*:*:*:*:*:*",
"matchCriteriaId": "3EC88614-E782-447B-B854-955498FAAA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc13:*:*:*:*:*:*:*",
"matchCriteriaId": "D2C1B8EE-3C12-452F-986E-6FD8A230685A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc14:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AC6851-F63E-47D7-BDEF-3BFF39E94D9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc15:*:*:*:*:*:*:*",
"matchCriteriaId": "685F5555-793D-4FAA-8CF4-578490CFAC6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc16:*:*:*:*:*:*:*",
"matchCriteriaId": "E688CF0C-134B-49E2-AEB3-45ECACB8B5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc17:*:*:*:*:*:*:*",
"matchCriteriaId": "1D385327-D1FF-4A22-A0C0-0C5AA53590C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc18:*:*:*:*:*:*:*",
"matchCriteriaId": "51329755-1DBF-40E1-960C-E924CDC4B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc19:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE65AC5-C218-456F-86FB-1C8BEC3C4598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc20:*:*:*:*:*:*:*",
"matchCriteriaId": "1412133F-3B44-43B6-A4FF-FF80E7B564E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc21:*:*:*:*:*:*:*",
"matchCriteriaId": "B55EE355-28A1-4955-9ADD-A8E02376C9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test1:*:*:*:*:*:*:*",
"matchCriteriaId": "E942C13E-6B54-465F-8026-ED49BD7EA2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test2:*:*:*:*:*:*:*",
"matchCriteriaId": "AADF30CF-AD36-45EB-AF50-EB0533B20B70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD078F82-361C-4B38-86E8-85E129F41A36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9831C92-7717-4650-8689-3C41B773C5CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test6:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3521E7-572E-4ADD-AAF6-F1AE505B4BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test7:*:*:*:*:*:*:*",
"matchCriteriaId": "F73290B2-384B-4B0F-8763-EF4D5D7C39FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test8:*:*:*:*:*:*:*",
"matchCriteriaId": "4728B3CD-5B54-4B0B-8967-DE7D9E1474F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test9:*:*:*:*:*:*:*",
"matchCriteriaId": "F353B495-D69A-4831-9E5B-F15F8F749C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test10:*:*:*:*:*:*:*",
"matchCriteriaId": "16647409-3ADD-4E86-A053-4A7B8365700E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5CA9F6-68FE-4412-8CD5-F85E970249F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test12:*:*:*:*:*:*:*",
"matchCriteriaId": "74A74354-1EAB-4A4F-A79C-C04E9BCDF594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test14:*:*:*:*:*:*:*",
"matchCriteriaId": "03A016A3-CAA9-4FCB-B909-F4163CE1E19E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test15:*:*:*:*:*:*:*",
"matchCriteriaId": "82A53B7C-8E9D-4DD6-8B00-628F7796A365",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test16:*:*:*:*:*:*:*",
"matchCriteriaId": "3D5AADA5-05DA-4660-9636-A3B737916A0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test17:*:*:*:*:*:*:*",
"matchCriteriaId": "2778FEDE-063B-4454-9FA7-F526334CF9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test18:*:*:*:*:*:*:*",
"matchCriteriaId": "989D471D-3F81-4018-A124-7FBEB3F4AB87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test19:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EA97AE-B2DD-40F8-81E1-467E895CE736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test20:*:*:*:*:*:*:*",
"matchCriteriaId": "F0C82A6A-4548-4508-B337-1061E57D78AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test21:*:*:*:*:*:*:*",
"matchCriteriaId": "36A972BC-6956-4195-933C-F3694BFEFB50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test22:*:*:*:*:*:*:*",
"matchCriteriaId": "E9EF5187-C008-4927-B5CB-A491768E9822",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test23:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A39ECE-7C8D-4BB8-A408-08EA0879F03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test24:*:*:*:*:*:*:*",
"matchCriteriaId": "6C67474C-3274-4F62-AF98-6953F9744522",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test26:*:*:*:*:*:*:*",
"matchCriteriaId": "D799CAF5-BFC3-4A80-8AE2-D292B7F9D9CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test27:*:*:*:*:*:*:*",
"matchCriteriaId": "98D3B905-FCD7-4136-A94C-76A95994CD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test29:*:*:*:*:*:*:*",
"matchCriteriaId": "1AE172A1-D9A5-4FF7-B316-4E0BD639B35D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted."
}
],
"id": "CVE-2005-2532",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-08-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/14607"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/14607"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 13:15
Modified
2024-11-21 06:21
Severity ?
Summary
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2021-3606 | Vendor Advisory | |
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2021-3606 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F9800A3-9DDA-44B2-9090-6E56BAA2DD71",
"versionEndExcluding": "2.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe)."
},
{
"lang": "es",
"value": "OpenVPN versiones anteriores a 2.5.3 en Windows permite a usuarios locales cargar bibliotecas arbitrarias de carga din\u00e1mica por medio de un archivo de configuraci\u00f3n de OpenSSL si est\u00e1 presente, permitiendo a un usuario ejecutar c\u00f3digo arbitrario con el mismo nivel de privilegio que el proceso principal de OpenVPN (openvpn.exe)"
}
],
"id": "CVE-2021-3606",
"lastModified": "2024-11-21T06:21:57.783",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T13:15:07.983",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3606"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2021-3606"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-427"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-427"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-04-26 14:15
Modified
2024-11-21 05:04
Severity ?
Summary
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2020-15078 | Patch, Vendor Advisory | |
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Broken Link | |
| security@openvpn.net | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory | |
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/ | ||
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/ | ||
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/ | ||
| security@openvpn.net | https://security.gentoo.org/glsa/202105-25 | Third Party Advisory | |
| security@openvpn.net | https://usn.ubuntu.com/usn/usn-4933-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2020-15078 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202105-25 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://usn.ubuntu.com/usn/usn-4933-1 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | * | |
| openvpn | openvpn | * | |
| fedoraproject | fedora | 32 | |
| fedoraproject | fedora | 33 | |
| fedoraproject | fedora | 34 | |
| canonical | ubuntu_linux | 18.04 | |
| canonical | ubuntu_linux | 20.04 | |
| canonical | ubuntu_linux | 20.10 | |
| canonical | ubuntu_linux | 21.04 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "76F53F5F-60D6-4F46-AF6A-A30045312564",
"versionEndExcluding": "2.4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C756C27-A377-4263-9A59-EB36DFDD5CFE",
"versionEndExcluding": "2.5.2",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*",
"matchCriteriaId": "338B3AAC-C147-4A31-95E7-6E8A6FB4B3FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*",
"matchCriteriaId": "8EF1C1CC-3FAE-4DE3-BC41-E5B14D5721F4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks."
},
{
"lang": "es",
"value": "OpenVPN versiones 2.5.1 y anteriores, permiten a atacantes remotos omitir la autenticaci\u00f3n y los datos del canal de control de acceso en servidores configurados con autenticaci\u00f3n diferida, que pueden ser usados para desencadenar potencialmente m\u00e1s fugas de informaci\u00f3n"
}
],
"id": "CVE-2020-15078",
"lastModified": "2024-11-21T05:04:45.900",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-04-26T14:15:08.623",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2020-15078"
},
{
"source": "security@openvpn.net",
"tags": [
"Broken Link"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"source": "security@openvpn.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/"
},
{
"source": "security@openvpn.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/"
},
{
"source": "security@openvpn.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/"
},
{
"source": "security@openvpn.net",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202105-25"
},
{
"source": "security@openvpn.net",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/usn/usn-4933-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2020-15078"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202105-25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/usn/usn-4933-1"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-305"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-07-08 11:15
Modified
2024-11-21 09:04
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2024-27459 | Vendor Advisory | |
| security@openvpn.net | https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ | Vendor Advisory | |
| security@openvpn.net | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html | Mailing List | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2024-27459 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html | Mailing List |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "62343D14-4C89-4E6F-9C74-46E7EEAF79CB",
"versionEndExcluding": "2.5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "0E77CFBC-2014-4588-B77C-C34E333645A7",
"versionEndExcluding": "2.6.10",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges."
},
{
"lang": "es",
"value": "El servicio interactivo en OpenVPN 2.6.9 y versiones anteriores permite a un atacante enviar datos provocando un desbordamiento de pila que puede usarse para ejecutar c\u00f3digo arbitrario con m\u00e1s privilegios."
}
],
"id": "CVE-2024-27459",
"lastModified": "2024-11-21T09:04:39.057",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2024-07-08T11:15:10.303",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27459"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27459"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-121"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-11-18 02:55
Modified
2025-04-11 00:51
Severity ?
Summary
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html | ||
| secalert@redhat.com | http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html | ||
| secalert@redhat.com | http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html | Vendor Advisory | |
| secalert@redhat.com | http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html | ||
| secalert@redhat.com | http://www.mandriva.com/security/advisories?name=MDVSA-2013:167 | ||
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2013/05/06/6 | ||
| secalert@redhat.com | https://bugs.gentoo.org/show_bug.cgi?id=468756 | ||
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=960192 | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc | ||
| secalert@redhat.com | https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDVSA-2013:167 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2013/05/06/6 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugs.gentoo.org/show_bug.cgi?id=468756 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=960192 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee | Exploit, Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | * | |
| openvpn | openvpn | 1.2.0 | |
| openvpn | openvpn | 1.2.1 | |
| openvpn | openvpn | 1.3.0 | |
| openvpn | openvpn | 1.3.1 | |
| openvpn | openvpn | 1.3.2 | |
| openvpn | openvpn | 1.4.0 | |
| openvpn | openvpn | 1.4.1 | |
| openvpn | openvpn | 1.4.2 | |
| openvpn | openvpn | 1.4.3 | |
| openvpn | openvpn | 1.5.0 | |
| openvpn | openvpn | 1.6.0 | |
| openvpn | openvpn | 2.1.0 | |
| openvpn | openvpn | 2.2.0 | |
| openvpn | openvpn_access_server | 2.0.0 | |
| opensuse | opensuse | 11.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC35891F-BC4F-4DBB-8879-4952685D419E",
"versionEndIncluding": "2.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "912E57A3-A4D0-4736-858F-51A500E886B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "13960B6E-F1E8-49E5-88A0-ECCC938AC4DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "862743EA-7B6E-4478-AD90-1F930E97BB2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79114721-FA19-43FF-8030-74652FCF937B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A3AF5D2-21CC-4243-A2A4-99273B7AD9D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B693F0CA-7A3A-42CA-A6BE-62D840CE336C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "345C3123-7E73-4094-8764-8BF881B6ABE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F00F2FF1-9CC2-446B-9468-1FB7D40371E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AB625AC3-B428-44BB-99F4-F0FE00DA1C5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C25DDCBB-798B-43BF-88FF-2EDB57BEA01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6FE9B-62E0-47E3-A977-DA51249A353B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "88C2922E-6E95-45BF-ABF1-B1D799769DB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1D915A07-3B93-4D7C-8D52-73B696392B46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "486CD3E2-1B1A-4A1D-98ED-0E2EEAB0A0CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DE554781-1EB9-446E-911F-6C11970C47F4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher."
},
{
"lang": "es",
"value": "La funci\u00f3n openvpn_decrypt en el archivo crypto.c en OpenVPN versiones 2.3.0 y anteriores, cuando se ejecuta en modo UDP, permite a los atacantes remotos obtener informaci\u00f3n confidencial por medio de un ataque de sincronizaci\u00f3n que implica una funci\u00f3n de comparaci\u00f3n HMAC que no se ejecuta en tiempo constante y un ataque de tipo padding oracle en el cifrado en modo CBC."
}
],
"id": "CVE-2013-2061",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-11-18T02:55:07.530",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:167"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/05/06/6"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=468756"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=960192"
},
{
"source": "secalert@redhat.com",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:167"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/05/06/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=468756"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=960192"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-04-02 21:15
Modified
2025-05-24 01:38
Severity ?
Summary
OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "2BC16851-89DA-4AFB-96D2-AAF258DCF5DC",
"versionEndIncluding": "2.6.13",
"versionStartIncluding": "2.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase"
},
{
"lang": "es",
"value": "Las versiones 2.6.1 a 2.6.13 de OpenVPN en modo servidor que utilizan TLS-crypt-v2 permiten a atacantes remotos provocar una denegaci\u00f3n de servicio al corromper y reproducir paquetes de red en la fase inicial del protocolo de enlace."
}
],
"id": "CVE-2025-2704",
"lastModified": "2025-05-24T01:38:01.433",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-04-02T21:15:32.943",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Broken Link"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2025-2704"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2025/04/02/5"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-754"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-754"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-05 19:02
Modified
2025-04-03 01:03
Severity ?
Summary
OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openvpn.net/man.html | ||
| cve@mitre.org | http://www.osvdb.org/25660 | ||
| cve@mitre.org | http://www.securityfocus.com/archive/1/432863/100/0/threaded | ||
| cve@mitre.org | http://www.securityfocus.com/archive/1/432867/100/0/threaded | ||
| cve@mitre.org | http://www.securityfocus.com/archive/1/433000/100/0/threaded | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/man.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/25660 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/432863/100/0/threaded | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/432867/100/0/threaded | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/433000/100/0/threaded |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0.1_rc1 | |
| openvpn | openvpn | 2.0.1_rc2 | |
| openvpn | openvpn | 2.0.1_rc3 | |
| openvpn | openvpn | 2.0.1_rc4 | |
| openvpn | openvpn | 2.0.1_rc5 | |
| openvpn | openvpn | 2.0.1_rc6 | |
| openvpn | openvpn | 2.0.1_rc7 | |
| openvpn | openvpn | 2.0.2_rc1 | |
| openvpn | openvpn | 2.0.3_rc1 | |
| openvpn | openvpn | 2.0.4 | |
| openvpn | openvpn | 2.0.6_rc1 | |
| openvpn | openvpn | 2.0_beta1 | |
| openvpn | openvpn | 2.0_beta2 | |
| openvpn | openvpn | 2.0_beta3 | |
| openvpn | openvpn | 2.0_beta4 | |
| openvpn | openvpn | 2.0_beta5 | |
| openvpn | openvpn | 2.0_beta6 | |
| openvpn | openvpn | 2.0_beta7 | |
| openvpn | openvpn | 2.0_beta8 | |
| openvpn | openvpn | 2.0_beta9 | |
| openvpn | openvpn | 2.0_beta10 | |
| openvpn | openvpn | 2.0_beta11 | |
| openvpn | openvpn | 2.0_beta12 | |
| openvpn | openvpn | 2.0_beta13 | |
| openvpn | openvpn | 2.0_beta15 | |
| openvpn | openvpn | 2.0_beta16 | |
| openvpn | openvpn | 2.0_beta17 | |
| openvpn | openvpn | 2.0_beta18 | |
| openvpn | openvpn | 2.0_beta19 | |
| openvpn | openvpn | 2.0_beta20 | |
| openvpn | openvpn | 2.0_beta28 | |
| openvpn | openvpn | 2.0_rc1 | |
| openvpn | openvpn | 2.0_rc2 | |
| openvpn | openvpn | 2.0_rc3 | |
| openvpn | openvpn | 2.0_rc4 | |
| openvpn | openvpn | 2.0_rc5 | |
| openvpn | openvpn | 2.0_rc6 | |
| openvpn | openvpn | 2.0_rc7 | |
| openvpn | openvpn | 2.0_rc8 | |
| openvpn | openvpn | 2.0_rc9 | |
| openvpn | openvpn | 2.0_rc10 | |
| openvpn | openvpn | 2.0_rc11 | |
| openvpn | openvpn | 2.0_rc12 | |
| openvpn | openvpn | 2.0_rc13 | |
| openvpn | openvpn | 2.0_rc14 | |
| openvpn | openvpn | 2.0_rc15 | |
| openvpn | openvpn | 2.0_rc16 | |
| openvpn | openvpn | 2.0_rc17 | |
| openvpn | openvpn | 2.0_rc18 | |
| openvpn | openvpn | 2.0_rc19 | |
| openvpn | openvpn | 2.0_rc20 | |
| openvpn | openvpn | 2.0_rc21 | |
| openvpn | openvpn | 2.0_test1 | |
| openvpn | openvpn | 2.0_test2 | |
| openvpn | openvpn | 2.0_test3 | |
| openvpn | openvpn | 2.0_test4 | |
| openvpn | openvpn | 2.0_test5 | |
| openvpn | openvpn | 2.0_test6 | |
| openvpn | openvpn | 2.0_test7 | |
| openvpn | openvpn | 2.0_test8 | |
| openvpn | openvpn | 2.0_test9 | |
| openvpn | openvpn | 2.0_test10 | |
| openvpn | openvpn | 2.0_test11 | |
| openvpn | openvpn | 2.0_test12 | |
| openvpn | openvpn | 2.0_test14 | |
| openvpn | openvpn | 2.0_test15 | |
| openvpn | openvpn | 2.0_test16 | |
| openvpn | openvpn | 2.0_test17 | |
| openvpn | openvpn | 2.0_test18 | |
| openvpn | openvpn | 2.0_test19 | |
| openvpn | openvpn | 2.0_test20 | |
| openvpn | openvpn | 2.0_test21 | |
| openvpn | openvpn | 2.0_test22 | |
| openvpn | openvpn | 2.0_test23 | |
| openvpn | openvpn | 2.0_test24 | |
| openvpn | openvpn | 2.0_test25 | |
| openvpn | openvpn | 2.0_test26 | |
| openvpn | openvpn | 2.0_test27 | |
| openvpn | openvpn | 2.0_test29 | |
| openvpn | openvpn_access_server | 2.0.1 | |
| openvpn | openvpn_access_server | 2.0.2 | |
| openvpn | openvpn_access_server | 2.0.5 | |
| openvpn | openvpn_access_server | 2.0.6 | |
| openvpn | openvpn_access_server | 2.0.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8D0ECEAF-401A-434E-9B0A-1A234BAEFC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "E751FA0E-0DF4-4F81-912A-1A132640246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "43F61AC6-EDF6-4818-BA51-3EAA299680B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "D32984D8-9631-407B-834E-303B9405A425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB44A872-3FE2-47E9-BA84-B6E1015E1973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "F020080D-7181-400D-988E-6844D1653464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "86D08038-9815-4222-9CD3-1211FE5954A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CE43EA96-5B3C-498F-A040-C800821DA49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.3_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "236F2BBF-0CF5-465E-9E65-8AD6D17F57A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8DF6B1F4-6313-4BF4-AD87-431A1C9D40C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA031086-95E4-4447-A06B-3B2926E3265F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "2BDEBEDA-437A-4942-8A71-7B25DD558BCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EB8A78E-DAB9-4A72-BC54-58230E1E9B9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta3:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D74ED1-34C5-4F95-A941-83664AFFF2ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta4:*:*:*:*:*:*:*",
"matchCriteriaId": "0747C1A9-C404-4FBD-AA8F-9DBB70FEB4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta5:*:*:*:*:*:*:*",
"matchCriteriaId": "5A3B1AD4-9EA0-4D86-90E1-3366FBC5629D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta6:*:*:*:*:*:*:*",
"matchCriteriaId": "8E483BD0-CAB9-4DA0-AAA4-A934B8318FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F04FAB1-A558-4F93-9FBF-043DE259A813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta8:*:*:*:*:*:*:*",
"matchCriteriaId": "A189A733-3130-41B4-94DD-E99E294D0FBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta9:*:*:*:*:*:*:*",
"matchCriteriaId": "7DEE5695-DC49-445D-864A-4739E16DF762",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta10:*:*:*:*:*:*:*",
"matchCriteriaId": "6FBF146F-2CFA-4F14-BFBC-E01B58F9F72B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5D263CA-8B2C-4B66-8990-6224BAF52A8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta12:*:*:*:*:*:*:*",
"matchCriteriaId": "825C9FCE-AD76-4E32-8FEC-EEFA0662BC04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta13:*:*:*:*:*:*:*",
"matchCriteriaId": "2C7519FA-831A-41D7-AFC3-B9457E6DFB4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta15:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB79AFD-493F-41F1-9EC1-8BCC0D28A914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta16:*:*:*:*:*:*:*",
"matchCriteriaId": "2C8F091B-194A-4FC5-87F4-A76CB490F3F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta17:*:*:*:*:*:*:*",
"matchCriteriaId": "11716B49-A920-4A1B-BEA5-4105213B9731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta18:*:*:*:*:*:*:*",
"matchCriteriaId": "756A7AF5-E502-4EDC-9693-4041C993E3BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta19:*:*:*:*:*:*:*",
"matchCriteriaId": "9885BC3E-1854-4561-9906-FFAEECA5B6FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta20:*:*:*:*:*:*:*",
"matchCriteriaId": "D7B7759F-F228-436D-BC86-7317B0109C02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta28:*:*:*:*:*:*:*",
"matchCriteriaId": "ADB9BD19-1BF9-42D0-9E43-7D95EE010347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0A6E23-6456-4305-A7DA-8CA1D506D4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "D985B9F0-5B4F-4120-8ECF-506C5F6179FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "CF7E6096-58BF-47F1-982B-27A9ED735AEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "62362541-FE20-47ED-9E03-94216A3D43CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BD7019-BBA5-4D08-85C8-571D2EC03FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1D56A4-A03C-445C-993B-1AA12024D4FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "F563B1FD-FC1F-4304-8141-A1188A190835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc8:*:*:*:*:*:*:*",
"matchCriteriaId": "4269ED1A-3031-4572-B134-62C6E533D176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc9:*:*:*:*:*:*:*",
"matchCriteriaId": "140999A7-E9BB-4459-B3F8-48DF8F5DFE0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc10:*:*:*:*:*:*:*",
"matchCriteriaId": "41CD75B0-24D0-40BA-A4FB-925BD5414298",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc11:*:*:*:*:*:*:*",
"matchCriteriaId": "DED8F3C5-8E43-4B07-8224-38BF4774F4CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc12:*:*:*:*:*:*:*",
"matchCriteriaId": "3EC88614-E782-447B-B854-955498FAAA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc13:*:*:*:*:*:*:*",
"matchCriteriaId": "D2C1B8EE-3C12-452F-986E-6FD8A230685A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc14:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AC6851-F63E-47D7-BDEF-3BFF39E94D9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc15:*:*:*:*:*:*:*",
"matchCriteriaId": "685F5555-793D-4FAA-8CF4-578490CFAC6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc16:*:*:*:*:*:*:*",
"matchCriteriaId": "E688CF0C-134B-49E2-AEB3-45ECACB8B5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc17:*:*:*:*:*:*:*",
"matchCriteriaId": "1D385327-D1FF-4A22-A0C0-0C5AA53590C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc18:*:*:*:*:*:*:*",
"matchCriteriaId": "51329755-1DBF-40E1-960C-E924CDC4B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc19:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE65AC5-C218-456F-86FB-1C8BEC3C4598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc20:*:*:*:*:*:*:*",
"matchCriteriaId": "1412133F-3B44-43B6-A4FF-FF80E7B564E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc21:*:*:*:*:*:*:*",
"matchCriteriaId": "B55EE355-28A1-4955-9ADD-A8E02376C9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test1:*:*:*:*:*:*:*",
"matchCriteriaId": "E942C13E-6B54-465F-8026-ED49BD7EA2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test2:*:*:*:*:*:*:*",
"matchCriteriaId": "AADF30CF-AD36-45EB-AF50-EB0533B20B70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD078F82-361C-4B38-86E8-85E129F41A36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test4:*:*:*:*:*:*:*",
"matchCriteriaId": "09ADBC1B-7835-4D63-AA86-EF056E008F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9831C92-7717-4650-8689-3C41B773C5CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test6:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3521E7-572E-4ADD-AAF6-F1AE505B4BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test7:*:*:*:*:*:*:*",
"matchCriteriaId": "F73290B2-384B-4B0F-8763-EF4D5D7C39FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test8:*:*:*:*:*:*:*",
"matchCriteriaId": "4728B3CD-5B54-4B0B-8967-DE7D9E1474F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test9:*:*:*:*:*:*:*",
"matchCriteriaId": "F353B495-D69A-4831-9E5B-F15F8F749C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test10:*:*:*:*:*:*:*",
"matchCriteriaId": "16647409-3ADD-4E86-A053-4A7B8365700E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5CA9F6-68FE-4412-8CD5-F85E970249F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test12:*:*:*:*:*:*:*",
"matchCriteriaId": "74A74354-1EAB-4A4F-A79C-C04E9BCDF594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test14:*:*:*:*:*:*:*",
"matchCriteriaId": "03A016A3-CAA9-4FCB-B909-F4163CE1E19E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test15:*:*:*:*:*:*:*",
"matchCriteriaId": "82A53B7C-8E9D-4DD6-8B00-628F7796A365",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test16:*:*:*:*:*:*:*",
"matchCriteriaId": "3D5AADA5-05DA-4660-9636-A3B737916A0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test17:*:*:*:*:*:*:*",
"matchCriteriaId": "2778FEDE-063B-4454-9FA7-F526334CF9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test18:*:*:*:*:*:*:*",
"matchCriteriaId": "989D471D-3F81-4018-A124-7FBEB3F4AB87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test19:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EA97AE-B2DD-40F8-81E1-467E895CE736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test20:*:*:*:*:*:*:*",
"matchCriteriaId": "F0C82A6A-4548-4508-B337-1061E57D78AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test21:*:*:*:*:*:*:*",
"matchCriteriaId": "36A972BC-6956-4195-933C-F3694BFEFB50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test22:*:*:*:*:*:*:*",
"matchCriteriaId": "E9EF5187-C008-4927-B5CB-A491768E9822",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test23:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A39ECE-7C8D-4BB8-A408-08EA0879F03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test24:*:*:*:*:*:*:*",
"matchCriteriaId": "6C67474C-3274-4F62-AF98-6953F9744522",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test25:*:*:*:*:*:*:*",
"matchCriteriaId": "5196B669-CF0F-4FED-9EAF-72F335436BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test26:*:*:*:*:*:*:*",
"matchCriteriaId": "D799CAF5-BFC3-4A80-8AE2-D292B7F9D9CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test27:*:*:*:*:*:*:*",
"matchCriteriaId": "98D3B905-FCD7-4136-A94C-76A95994CD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test29:*:*:*:*:*:*:*",
"matchCriteriaId": "1AE172A1-D9A5-4FF7-B316-4E0BD639B35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B42CB75B-355B-4D80-91EA-77723B275D0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E5EFEC7-D9B6-454A-A36A-C75874564FCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4ED93D78-3BA8-43DB-B5AF-D2D3941C9DAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C2B16482-8058-46A8-9D56-DB73BFE32A1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "F105F380-57BF-44BD-B31D-9D36DF9210A5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service."
}
],
"id": "CVE-2006-2229",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-05T19:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openvpn.net/man.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/25660"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/432863/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/432867/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/433000/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/man.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/25660"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/432863/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/432867/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/433000/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-11-01 12:47
Modified
2025-04-03 01:03
Severity ?
Summary
Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://marc.info/?l=bugtraq&m=113081023121059&w=2 | ||
| cve@mitre.org | http://openvpn.net/changelog.html | ||
| cve@mitre.org | http://secunia.com/advisories/17376 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17447 | ||
| cve@mitre.org | http://secunia.com/advisories/17452 | ||
| cve@mitre.org | http://secunia.com/advisories/17480 | ||
| cve@mitre.org | http://www.debian.org/security/2005/dsa-885 | ||
| cve@mitre.org | http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml | ||
| cve@mitre.org | http://www.novell.com/linux/security/advisories/2005_25_sr.html | ||
| cve@mitre.org | http://www.securityfocus.com/archive/1/415487 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/15239 | Patch | |
| cve@mitre.org | http://www.vupen.com/english/advisories/2005/2255 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://marc.info/?l=bugtraq&m=113081023121059&w=2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/changelog.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17376 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17447 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17452 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17480 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2005/dsa-885 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.novell.com/linux/security/advisories/2005_25_sr.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/415487 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15239 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2005/2255 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0_beta11 | |
| openvpn | openvpn_access_server | 2.0.1 | |
| openvpn | openvpn_access_server | 2.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5D263CA-8B2C-4B66-8990-6224BAF52A8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B42CB75B-355B-4D80-91EA-77723B275D0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E5EFEC7-D9B6-454A-A36A-C75874564FCF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option."
}
],
"id": "CVE-2005-3393",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": true,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-11-01T12:47:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=113081023121059\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17376"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17447"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17452"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17480"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15239"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/2255"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=113081023121059\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17376"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17447"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17452"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17480"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-885"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200511-07.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_25_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/415487"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15239"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/2255"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-15 18:29
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.securityfocus.com/bid/98444 | ||
| secalert@redhat.com | http://www.securitytracker.com/id/1038473 | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits | Vendor Advisory | |
| secalert@redhat.com | https://www.exploit-db.com/exploits/41993/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/98444 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1038473 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/41993/ |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.12:*:*:*:*:*:*:*",
"matchCriteriaId": "288EE3C5-C915-4273-B1F1-D53BC028C990",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.13:*:*:*:*:*:*:*",
"matchCriteriaId": "A21C5FE2-2FF7-481F-B128-976EBA563208",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.14:*:*:*:*:*:*:*",
"matchCriteriaId": "FF068FA2-03A0-4C7F-97B1-9CB5A49E9E1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84F5C67A-34A4-4C7E-BCA9-AF3E5FC70AF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "A857CA88-60B0-4D34-87B6-770B67981501",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B42297EE-B347-4BD8-A657-BDF0AA010C06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "7C7A56E8-09C8-4DB2-9244-9E5E2BEC1821",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "41ACD637-EF6B-40E4-BDE6-0EE7D6AEBAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1A4150AD-3F46-487D-BCF8-79D0AE2A092D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E7F7663E-3EB5-44F4-B7DE-294A549A12BE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2."
},
{
"lang": "es",
"value": "OpenVPN versi\u00f3n 2.3.12 y m\u00e1s recientes, son vulnerables a la Denegaci\u00f3n de Servicio no autenticada del servidor por medio de un paquete de control grande recibido. Tenga en cuenta que este problema se corrige en versiones 2.3.15 y 2.4.2."
}
],
"id": "CVE-2017-7478",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-05-15T18:29:00.293",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/98444"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id/1038473"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"source": "secalert@redhat.com",
"url": "https://www.exploit-db.com/exploits/41993/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/98444"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038473"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/41993/"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-08-04 19:41
Modified
2025-04-09 00:30
Severity ?
Summary
Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://openvpn.net/index.php/documentation/change-log/changelog-21.html | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/30532 | ||
| secalert@redhat.com | http://www.securitytracker.com/id?1020626 | ||
| secalert@redhat.com | http://www.vupen.com/english/advisories/2008/2316 | Vendor Advisory | |
| secalert@redhat.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/44209 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/index.php/documentation/change-log/changelog-21.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/30532 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id?1020626 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2008/2316 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/44209 |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-14:*:*:*:*:*:*",
"matchCriteriaId": "C6826F2C-9769-4F70-8121-988986C9DAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-15:*:*:*:*:*:*",
"matchCriteriaId": "38CDC26A-2EA1-4FD1-BE82-09ABE335A778",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:beta-16:*:*:*:*:*:*",
"matchCriteriaId": "F4284CC6-B78D-478D-B815-3FB4D884A726",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_1:*:*:*:*:*:*",
"matchCriteriaId": "F972B6E6-0553-454E-BF58-107E7A9EC9E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_2:*:*:*:*:*:*",
"matchCriteriaId": "9DBF4843-5E4F-4C47-BBF8-4ADB45C422E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_3:*:*:*:*:*:*",
"matchCriteriaId": "61BB61B4-2769-4F59-875F-9269C551E386",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_4:*:*:*:*:*:*",
"matchCriteriaId": "DBD947CF-98BC-4C84-8149-B4EEFF1015AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_5:*:*:*:*:*:*",
"matchCriteriaId": "FE621907-2D6B-4558-A9B9-E98AAF236D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_6:*:*:*:*:*:*",
"matchCriteriaId": "B57458F3-B8F9-454E-98B1-9FA33ABDF0BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_7:*:*:*:*:*:*",
"matchCriteriaId": "42F0E1FF-0863-418C-BD26-F3B18B257370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1:rc_8:*:*:*:*:*:*",
"matchCriteriaId": "B0E905D4-34F6-4ACD-8D86-0C9E29EDB282",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters."
},
{
"lang": "es",
"value": "Una vulnerabilidad no especificada en OpenVPN versiones 2.1-beta14 hasta 2.1-rc8, cuando se ejecuta en sistemas que no son Windows, permite a los servidores remotos ejecutar comandos arbitrarios por medio de la configuraci\u00f3n de directivas dise\u00f1adas (1) lladdr y (2) iproute, probablemente relacionadas con los metacaracteres de shell."
}
],
"evaluatorImpact": "The following events must take place for successful exploitation:\r\n1) the client has agreed to allow the server to push configuration directives to it by including \"pull\" or the macro \"client\" in its configuration file\r\n2) the client succesfully authenticates the server \r\n3) the server is malicious or has been compromised and is under the control of the attacker\r\n4) the client is running a non-Windows OS.",
"id": "CVE-2008-3459",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-08-04T19:41:00.000",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://openvpn.net/index.php/documentation/change-log/changelog-21.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/30532"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id?1020626"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/2316"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44209"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/index.php/documentation/change-log/changelog-21.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/30532"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1020626"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/2316"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44209"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-16"
},
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-15 18:29
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.debian.org/security/2017/dsa-3900 | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/98443 | ||
| secalert@redhat.com | http://www.securitytracker.com/id/1038473 | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2017/dsa-3900 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/98443 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1038473 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B92389B-7815-40EC-AA21-14154621BFAC",
"versionEndIncluding": "2.3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84F5C67A-34A4-4C7E-BCA9-AF3E5FC70AF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "A857CA88-60B0-4D34-87B6-770B67981501",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B42297EE-B347-4BD8-A657-BDF0AA010C06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "7C7A56E8-09C8-4DB2-9244-9E5E2BEC1821",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "41ACD637-EF6B-40E4-BDE6-0EE7D6AEBAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1A4150AD-3F46-487D-BCF8-79D0AE2A092D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E7F7663E-3EB5-44F4-B7DE-294A549A12BE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker."
},
{
"lang": "es",
"value": "OpenVPN versiones anteriores a 2.3.15 y anteriores a 2.4.2, son vulnerables a una aserci\u00f3n alcanzable cuando el contador del identificador de paquete se devuelve como resultado de una denegaci\u00f3n de servicio del servidor por parte de un atacante autenticado."
}
],
"id": "CVE-2017-7479",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-05-15T18:29:00.340",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/98443"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id/1038473"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/98443"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038473"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-04-03 16:15
Modified
2025-04-29 19:45
Severity ?
Summary
OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2024-4877 | Permissions Required | |
| security@openvpn.net | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html | Release Notes, Mailing List |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "C87B630D-FF25-4172-AE95-D5D93DF2286A",
"versionEndExcluding": "2.6.11",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges"
},
{
"lang": "es",
"value": "Las versiones 2.4.0 a 2.6.10 de OpenVPN en Windows permiten que un proceso externo con menos privilegios cree una tuber\u00eda con nombre a la que se conectar\u00eda el componente GUI de OpenVPN, lo que le permitir\u00eda escalar sus privilegios."
}
],
"id": "CVE-2024-4877",
"lastModified": "2025-04-29T19:45:07.223",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-04-03T16:15:32.840",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Permissions Required"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-4877"
},
{
"source": "security@openvpn.net",
"tags": [
"Release Notes",
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-268"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-07-08 11:15
Modified
2024-11-21 09:05
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2024-27903 | Vendor Advisory | |
| security@openvpn.net | https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ | Vendor Advisory | |
| security@openvpn.net | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html | Mailing List | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2024-27903 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html | Mailing List |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "62343D14-4C89-4E6F-9C74-46E7EEAF79CB",
"versionEndExcluding": "2.5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "0E77CFBC-2014-4588-B77C-C34E333645A7",
"versionEndExcluding": "2.6.10",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service."
},
{
"lang": "es",
"value": "Los complementos de OpenVPN en Windows con OpenVPN 2.6.9 y versiones anteriores se pueden cargar desde cualquier directorio, lo que permite a un atacante cargar un complemento arbitrario que puede usarse para interactuar con el servicio interactivo privilegiado OpenVPN."
}
],
"id": "CVE-2024-27903",
"lastModified": "2024-11-21T09:05:23.177",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2024-07-08T11:15:10.390",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-27903"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-283"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-06-27 13:29
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.debian.org/security/2017/dsa-3900 | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| secalert@redhat.com | http://www.securitytracker.com/id/1038768 | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2017/dsa-3900 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1038768 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "216840B9-FCDB-4921-BE12-2A1FA42F8FDE",
"versionEndIncluding": "2.3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84F5C67A-34A4-4C7E-BCA9-AF3E5FC70AF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "A857CA88-60B0-4D34-87B6-770B67981501",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B42297EE-B347-4BD8-A657-BDF0AA010C06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "7C7A56E8-09C8-4DB2-9244-9E5E2BEC1821",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "41ACD637-EF6B-40E4-BDE6-0EE7D6AEBAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1A4150AD-3F46-487D-BCF8-79D0AE2A092D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E7F7663E-3EB5-44F4-B7DE-294A549A12BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "81434C3E-F992-4F29-9092-6823989B6909",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet."
},
{
"lang": "es",
"value": "Las versiones anteriores a 2.4.3 y anterior a 2.3.17 de OpenVPN, son vulnerables a la denegaci\u00f3n de servicio remota cuando se reciben paquetes IPv6 malformados."
}
],
"id": "CVE-2017-7508",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-06-27T13:29:00.177",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-11-11 01:15
Modified
2025-06-11 15:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 | Vendor Advisory | |
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ | Mailing List | |
| security@openvpn.net | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/ | ||
| security@openvpn.net | https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ | Vendor Advisory | |
| security@openvpn.net | https://www.debian.org/security/2023/dsa-5555 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ | Mailing List | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2023/dsa-5555 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | * | |
| openvpn | openvpn_access_server | * | |
| openvpn | openvpn_access_server | 2.12.0 | |
| openvpn | openvpn_access_server | 2.12.1 | |
| debian | debian_linux | 12.0 | |
| fedoraproject | fedora | 39 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "3A398A7A-395F-4CA8-9D72-1DDD337D5074",
"versionEndIncluding": "2.6.6",
"versionStartIncluding": "2.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54464223-5988-40E7-B94B-D7B8DE999704",
"versionEndIncluding": "2.11.3",
"versionStartIncluding": "2.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F8A71564-0966-47F0-BB81-B6BFA071E402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn_access_server:2.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AC187755-A908-4CD5-8F35-869EA5D9A3B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service."
},
{
"lang": "es",
"value": "El uso de la opci\u00f3n --fragment en ciertas configuraciones de OpenVPN versi\u00f3n 2.6.0 a 2.6.6 permite a un atacante desencadenar un comportamiento de divisi\u00f3n por cero que podr\u00eda provocar un bloqueo de la aplicaci\u00f3n y provocar una denegaci\u00f3n de servicio."
}
],
"id": "CVE-2023-46849",
"lastModified": "2025-06-11T15:15:26.793",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2023-11-11T01:15:07.270",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46849"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"source": "security@openvpn.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"source": "security@openvpn.net",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5555"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2023-46849"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5555"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-369"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-369"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-01-06 14:15
Modified
2025-06-10 16:26
Severity ?
Summary
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "0D6C4FD9-4627-4A45-89FC-2DB53985C516",
"versionEndExcluding": "2.6.11",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs."
},
{
"lang": "es",
"value": "OpenVPN anterior a 2.6.11 no desinfecta adecuadamente los mensajes PUSH_REPLY, lo cual los atacantes pueden usar para inyectar datos arbitrarios inesperados en ejecutables o complementos de terceros."
}
],
"id": "CVE-2024-5594",
"lastModified": "2025-06-10T16:26:11.807",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-01-06T14:15:08.807",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-5594"
},
{
"source": "security@openvpn.net",
"tags": [
"Release Notes"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1287"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-08-24 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openvpn.net/changelog.html | ||
| cve@mitre.org | http://secunia.com/advisories/16463 | ||
| cve@mitre.org | http://secunia.com/advisories/17103 | ||
| cve@mitre.org | http://www.debian.org/security/2005/dsa-851 | ||
| cve@mitre.org | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.novell.com/linux/security/advisories/2005_20_sr.html | ||
| cve@mitre.org | http://www.securityfocus.com/bid/14605 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openvpn.net/changelog.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/16463 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17103 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2005/dsa-851 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mandriva.com/security/advisories?name=MDKSA-2005:145 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.novell.com/linux/security/advisories/2005_20_sr.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/14605 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.0 | |
| openvpn | openvpn | 2.0.1_rc1 | |
| openvpn | openvpn | 2.0.1_rc2 | |
| openvpn | openvpn | 2.0.1_rc3 | |
| openvpn | openvpn | 2.0.1_rc4 | |
| openvpn | openvpn | 2.0.1_rc5 | |
| openvpn | openvpn | 2.0.1_rc6 | |
| openvpn | openvpn | 2.0.1_rc7 | |
| openvpn | openvpn | 2.0_beta1 | |
| openvpn | openvpn | 2.0_beta2 | |
| openvpn | openvpn | 2.0_beta3 | |
| openvpn | openvpn | 2.0_beta4 | |
| openvpn | openvpn | 2.0_beta5 | |
| openvpn | openvpn | 2.0_beta6 | |
| openvpn | openvpn | 2.0_beta7 | |
| openvpn | openvpn | 2.0_beta8 | |
| openvpn | openvpn | 2.0_beta9 | |
| openvpn | openvpn | 2.0_beta10 | |
| openvpn | openvpn | 2.0_beta11 | |
| openvpn | openvpn | 2.0_beta12 | |
| openvpn | openvpn | 2.0_beta13 | |
| openvpn | openvpn | 2.0_beta15 | |
| openvpn | openvpn | 2.0_beta16 | |
| openvpn | openvpn | 2.0_beta17 | |
| openvpn | openvpn | 2.0_beta18 | |
| openvpn | openvpn | 2.0_beta19 | |
| openvpn | openvpn | 2.0_beta20 | |
| openvpn | openvpn | 2.0_beta28 | |
| openvpn | openvpn | 2.0_rc1 | |
| openvpn | openvpn | 2.0_rc2 | |
| openvpn | openvpn | 2.0_rc3 | |
| openvpn | openvpn | 2.0_rc4 | |
| openvpn | openvpn | 2.0_rc5 | |
| openvpn | openvpn | 2.0_rc6 | |
| openvpn | openvpn | 2.0_rc7 | |
| openvpn | openvpn | 2.0_rc8 | |
| openvpn | openvpn | 2.0_rc9 | |
| openvpn | openvpn | 2.0_rc10 | |
| openvpn | openvpn | 2.0_rc11 | |
| openvpn | openvpn | 2.0_rc12 | |
| openvpn | openvpn | 2.0_rc13 | |
| openvpn | openvpn | 2.0_rc14 | |
| openvpn | openvpn | 2.0_rc15 | |
| openvpn | openvpn | 2.0_rc16 | |
| openvpn | openvpn | 2.0_rc17 | |
| openvpn | openvpn | 2.0_rc18 | |
| openvpn | openvpn | 2.0_rc19 | |
| openvpn | openvpn | 2.0_rc20 | |
| openvpn | openvpn | 2.0_rc21 | |
| openvpn | openvpn | 2.0_test1 | |
| openvpn | openvpn | 2.0_test2 | |
| openvpn | openvpn | 2.0_test3 | |
| openvpn | openvpn | 2.0_test5 | |
| openvpn | openvpn | 2.0_test6 | |
| openvpn | openvpn | 2.0_test7 | |
| openvpn | openvpn | 2.0_test8 | |
| openvpn | openvpn | 2.0_test9 | |
| openvpn | openvpn | 2.0_test10 | |
| openvpn | openvpn | 2.0_test11 | |
| openvpn | openvpn | 2.0_test12 | |
| openvpn | openvpn | 2.0_test14 | |
| openvpn | openvpn | 2.0_test15 | |
| openvpn | openvpn | 2.0_test16 | |
| openvpn | openvpn | 2.0_test17 | |
| openvpn | openvpn | 2.0_test18 | |
| openvpn | openvpn | 2.0_test19 | |
| openvpn | openvpn | 2.0_test20 | |
| openvpn | openvpn | 2.0_test21 | |
| openvpn | openvpn | 2.0_test22 | |
| openvpn | openvpn | 2.0_test23 | |
| openvpn | openvpn | 2.0_test24 | |
| openvpn | openvpn | 2.0_test26 | |
| openvpn | openvpn | 2.0_test27 | |
| openvpn | openvpn | 2.0_test29 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6457C946-123B-4B85-9253-D284A7A16A61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8D0ECEAF-401A-434E-9B0A-1A234BAEFC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "E751FA0E-0DF4-4F81-912A-1A132640246D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "43F61AC6-EDF6-4818-BA51-3EAA299680B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "D32984D8-9631-407B-834E-303B9405A425",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB44A872-3FE2-47E9-BA84-B6E1015E1973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "F020080D-7181-400D-988E-6844D1653464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0.1_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "86D08038-9815-4222-9CD3-1211FE5954A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "2BDEBEDA-437A-4942-8A71-7B25DD558BCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EB8A78E-DAB9-4A72-BC54-58230E1E9B9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta3:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D74ED1-34C5-4F95-A941-83664AFFF2ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta4:*:*:*:*:*:*:*",
"matchCriteriaId": "0747C1A9-C404-4FBD-AA8F-9DBB70FEB4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta5:*:*:*:*:*:*:*",
"matchCriteriaId": "5A3B1AD4-9EA0-4D86-90E1-3366FBC5629D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta6:*:*:*:*:*:*:*",
"matchCriteriaId": "8E483BD0-CAB9-4DA0-AAA4-A934B8318FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F04FAB1-A558-4F93-9FBF-043DE259A813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta8:*:*:*:*:*:*:*",
"matchCriteriaId": "A189A733-3130-41B4-94DD-E99E294D0FBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta9:*:*:*:*:*:*:*",
"matchCriteriaId": "7DEE5695-DC49-445D-864A-4739E16DF762",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta10:*:*:*:*:*:*:*",
"matchCriteriaId": "6FBF146F-2CFA-4F14-BFBC-E01B58F9F72B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5D263CA-8B2C-4B66-8990-6224BAF52A8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta12:*:*:*:*:*:*:*",
"matchCriteriaId": "825C9FCE-AD76-4E32-8FEC-EEFA0662BC04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta13:*:*:*:*:*:*:*",
"matchCriteriaId": "2C7519FA-831A-41D7-AFC3-B9457E6DFB4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta15:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB79AFD-493F-41F1-9EC1-8BCC0D28A914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta16:*:*:*:*:*:*:*",
"matchCriteriaId": "2C8F091B-194A-4FC5-87F4-A76CB490F3F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta17:*:*:*:*:*:*:*",
"matchCriteriaId": "11716B49-A920-4A1B-BEA5-4105213B9731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta18:*:*:*:*:*:*:*",
"matchCriteriaId": "756A7AF5-E502-4EDC-9693-4041C993E3BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta19:*:*:*:*:*:*:*",
"matchCriteriaId": "9885BC3E-1854-4561-9906-FFAEECA5B6FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta20:*:*:*:*:*:*:*",
"matchCriteriaId": "D7B7759F-F228-436D-BC86-7317B0109C02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_beta28:*:*:*:*:*:*:*",
"matchCriteriaId": "ADB9BD19-1BF9-42D0-9E43-7D95EE010347",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0A6E23-6456-4305-A7DA-8CA1D506D4F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "D985B9F0-5B4F-4120-8ECF-506C5F6179FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "CF7E6096-58BF-47F1-982B-27A9ED735AEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc4:*:*:*:*:*:*:*",
"matchCriteriaId": "62362541-FE20-47ED-9E03-94216A3D43CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc5:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BD7019-BBA5-4D08-85C8-571D2EC03FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D1D56A4-A03C-445C-993B-1AA12024D4FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc7:*:*:*:*:*:*:*",
"matchCriteriaId": "F563B1FD-FC1F-4304-8141-A1188A190835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc8:*:*:*:*:*:*:*",
"matchCriteriaId": "4269ED1A-3031-4572-B134-62C6E533D176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc9:*:*:*:*:*:*:*",
"matchCriteriaId": "140999A7-E9BB-4459-B3F8-48DF8F5DFE0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc10:*:*:*:*:*:*:*",
"matchCriteriaId": "41CD75B0-24D0-40BA-A4FB-925BD5414298",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc11:*:*:*:*:*:*:*",
"matchCriteriaId": "DED8F3C5-8E43-4B07-8224-38BF4774F4CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc12:*:*:*:*:*:*:*",
"matchCriteriaId": "3EC88614-E782-447B-B854-955498FAAA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc13:*:*:*:*:*:*:*",
"matchCriteriaId": "D2C1B8EE-3C12-452F-986E-6FD8A230685A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc14:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AC6851-F63E-47D7-BDEF-3BFF39E94D9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc15:*:*:*:*:*:*:*",
"matchCriteriaId": "685F5555-793D-4FAA-8CF4-578490CFAC6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc16:*:*:*:*:*:*:*",
"matchCriteriaId": "E688CF0C-134B-49E2-AEB3-45ECACB8B5FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc17:*:*:*:*:*:*:*",
"matchCriteriaId": "1D385327-D1FF-4A22-A0C0-0C5AA53590C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc18:*:*:*:*:*:*:*",
"matchCriteriaId": "51329755-1DBF-40E1-960C-E924CDC4B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc19:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE65AC5-C218-456F-86FB-1C8BEC3C4598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc20:*:*:*:*:*:*:*",
"matchCriteriaId": "1412133F-3B44-43B6-A4FF-FF80E7B564E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_rc21:*:*:*:*:*:*:*",
"matchCriteriaId": "B55EE355-28A1-4955-9ADD-A8E02376C9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test1:*:*:*:*:*:*:*",
"matchCriteriaId": "E942C13E-6B54-465F-8026-ED49BD7EA2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test2:*:*:*:*:*:*:*",
"matchCriteriaId": "AADF30CF-AD36-45EB-AF50-EB0533B20B70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD078F82-361C-4B38-86E8-85E129F41A36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test5:*:*:*:*:*:*:*",
"matchCriteriaId": "F9831C92-7717-4650-8689-3C41B773C5CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test6:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3521E7-572E-4ADD-AAF6-F1AE505B4BB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test7:*:*:*:*:*:*:*",
"matchCriteriaId": "F73290B2-384B-4B0F-8763-EF4D5D7C39FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test8:*:*:*:*:*:*:*",
"matchCriteriaId": "4728B3CD-5B54-4B0B-8967-DE7D9E1474F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test9:*:*:*:*:*:*:*",
"matchCriteriaId": "F353B495-D69A-4831-9E5B-F15F8F749C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test10:*:*:*:*:*:*:*",
"matchCriteriaId": "16647409-3ADD-4E86-A053-4A7B8365700E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5CA9F6-68FE-4412-8CD5-F85E970249F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test12:*:*:*:*:*:*:*",
"matchCriteriaId": "74A74354-1EAB-4A4F-A79C-C04E9BCDF594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test14:*:*:*:*:*:*:*",
"matchCriteriaId": "03A016A3-CAA9-4FCB-B909-F4163CE1E19E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test15:*:*:*:*:*:*:*",
"matchCriteriaId": "82A53B7C-8E9D-4DD6-8B00-628F7796A365",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test16:*:*:*:*:*:*:*",
"matchCriteriaId": "3D5AADA5-05DA-4660-9636-A3B737916A0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test17:*:*:*:*:*:*:*",
"matchCriteriaId": "2778FEDE-063B-4454-9FA7-F526334CF9F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test18:*:*:*:*:*:*:*",
"matchCriteriaId": "989D471D-3F81-4018-A124-7FBEB3F4AB87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test19:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EA97AE-B2DD-40F8-81E1-467E895CE736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test20:*:*:*:*:*:*:*",
"matchCriteriaId": "F0C82A6A-4548-4508-B337-1061E57D78AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test21:*:*:*:*:*:*:*",
"matchCriteriaId": "36A972BC-6956-4195-933C-F3694BFEFB50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test22:*:*:*:*:*:*:*",
"matchCriteriaId": "E9EF5187-C008-4927-B5CB-A491768E9822",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test23:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A39ECE-7C8D-4BB8-A408-08EA0879F03F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test24:*:*:*:*:*:*:*",
"matchCriteriaId": "6C67474C-3274-4F62-AF98-6953F9744522",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test26:*:*:*:*:*:*:*",
"matchCriteriaId": "D799CAF5-BFC3-4A80-8AE2-D292B7F9D9CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test27:*:*:*:*:*:*:*",
"matchCriteriaId": "98D3B905-FCD7-4136-A94C-76A95994CD85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.0_test29:*:*:*:*:*:*:*",
"matchCriteriaId": "1AE172A1-D9A5-4FF7-B316-4E0BD639B35D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN before 2.0.1, when running with \"verb 0\" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts."
}
],
"id": "CVE-2005-2531",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-08-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_20_sr.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/14605"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openvpn.net/changelog.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/16463"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17103"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-851"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_20_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/14605"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-06-27 13:29
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.debian.org/security/2017/dsa-3900 | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| secalert@redhat.com | http://www.securitytracker.com/id/1038768 | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2017/dsa-3900 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1038768 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "216840B9-FCDB-4921-BE12-2A1FA42F8FDE",
"versionEndIncluding": "2.3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84F5C67A-34A4-4C7E-BCA9-AF3E5FC70AF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "A857CA88-60B0-4D34-87B6-770B67981501",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B42297EE-B347-4BD8-A657-BDF0AA010C06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "7C7A56E8-09C8-4DB2-9244-9E5E2BEC1821",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "41ACD637-EF6B-40E4-BDE6-0EE7D6AEBAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1A4150AD-3F46-487D-BCF8-79D0AE2A092D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E7F7663E-3EB5-44F4-B7DE-294A549A12BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "81434C3E-F992-4F29-9092-6823989B6909",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker."
},
{
"lang": "es",
"value": "Las versiones anteriores a 2.4.3 y anterior a 2.3.17 de OpenVPN, son vulnerables a la denegaci\u00f3n de servicio y/o posiblemente a la p\u00e9rdida de memoria confidencial activada por un atacante de tipo man-in-the-middle."
}
],
"id": "CVE-2017-7520",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-06-27T13:29:00.210",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2017/dsa-3900"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697 | Permissions Required, Third Party Advisory | |
| secalert@redhat.com | http://www-01.ibm.com/support/docview.wss?uid=swg21991482 | Third Party Advisory | |
| secalert@redhat.com | http://www-01.ibm.com/support/docview.wss?uid=swg21995039 | Third Party Advisory | |
| secalert@redhat.com | http://www.securityfocus.com/bid/92631 | Third Party Advisory, VDB Entry | |
| secalert@redhat.com | http://www.securitytracker.com/id/1036695 | Third Party Advisory, VDB Entry | |
| secalert@redhat.com | https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/SWEET32 | Vendor Advisory | |
| secalert@redhat.com | https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403 | Third Party Advisory | |
| secalert@redhat.com | https://security.gentoo.org/glsa/201611-02 | Third Party Advisory | |
| secalert@redhat.com | https://sweet32.info/ | Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697 | Permissions Required, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www-01.ibm.com/support/docview.wss?uid=swg21991482 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www-01.ibm.com/support/docview.wss?uid=swg21995039 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92631 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1036695 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/SWEET32 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201611-02 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://sweet32.info/ | Technical Description, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B92389B-7815-40EC-AA21-14154621BFAC",
"versionEndIncluding": "2.3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a \"Sweet32\" attack."
},
{
"lang": "es",
"value": "OpenVPN, cuando utiliza un cifrado de bloques de 64 bits, facilita a atacantes remotos obtener datos de texto plano a trav\u00e9s de un ataque birthday contra una sesi\u00f3n encriptada de larga duraci\u00f3n, como lo demuestra una sesi\u00f3n HTTP-over-OpenVPN usando Blowfish en modo CBC, tambi\u00e9n conocido como ataque \"Sweet32\"."
}
],
"id": "CVE-2016-6329",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-31T22:59:00.377",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Permissions Required",
"Third Party Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991482"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92631"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1036695"
},
{
"source": "secalert@redhat.com",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SWEET32"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201611-02"
},
{
"source": "secalert@redhat.com",
"tags": [
"Technical Description",
"Third Party Advisory"
],
"url": "https://sweet32.info/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Third Party Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991482"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92631"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1036695"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/SWEET32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201611-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Technical Description",
"Third Party Advisory"
],
"url": "https://sweet32.info/"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-08-22 19:16
Modified
2024-11-21 05:12
Severity ?
Summary
Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.freebuf.com/vuls/215171.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.freebuf.com/vuls/215171.html | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CFC97CFC-E7F4-428D-AFDE-DFEC100A7728",
"versionEndIncluding": "2.4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet."
},
{
"lang": "es",
"value": "El componente Control Channel de OpenVPN v2.4.7 y anteriores permite a atacantes remotos provocar una denegaci\u00f3n de servicio a trav\u00e9s de un paquete de restablecimiento manipulado."
}
],
"id": "CVE-2020-20813",
"lastModified": "2024-11-21T05:12:17.083",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-22T19:16:08.247",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.freebuf.com/vuls/215171.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.freebuf.com/vuls/215171.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-06-27 13:29
Modified
2025-04-20 01:37
Severity ?
Summary
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| secalert@redhat.com | http://www.securitytracker.com/id/1038768 | ||
| secalert@redhat.com | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/99230 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1038768 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "216840B9-FCDB-4921-BE12-2A1FA42F8FDE",
"versionEndIncluding": "2.3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84F5C67A-34A4-4C7E-BCA9-AF3E5FC70AF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "A857CA88-60B0-4D34-87B6-770B67981501",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B42297EE-B347-4BD8-A657-BDF0AA010C06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "7C7A56E8-09C8-4DB2-9244-9E5E2BEC1821",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "41ACD637-EF6B-40E4-BDE6-0EE7D6AEBAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1A4150AD-3F46-487D-BCF8-79D0AE2A092D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E7F7663E-3EB5-44F4-B7DE-294A549A12BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "81434C3E-F992-4F29-9092-6823989B6909",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character."
},
{
"lang": "es",
"value": "Las versiones de OpenVPN anteriores a 2.4.3 y 2.3.17, son vulnerables a una denegaci\u00f3n de servicio por parte de un atacante remoto autenticado mediante el env\u00edo de un certificado con un car\u00e1cter NULL insertado."
}
],
"id": "CVE-2017-7522",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-06-27T13:29:00.273",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99230"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038768"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-16 15:29
Modified
2024-11-21 04:12
Severity ?
Summary
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a "signal SIGTERM" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html | Exploit, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DE001042-A74F-441C-8ED2-B4CF71299080",
"versionEndIncluding": "2.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a \"signal SIGTERM\" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning"
},
{
"lang": "es",
"value": "** EN DISPUTA ** Se ha descubierto un problema en la interfaz de gesti\u00f3n en OpenVPN hasta la versi\u00f3n 2.4.5. Cuando esta interfaz est\u00e1 habilitada en TCP sin contrase\u00f1a y cuando no hay m\u00e1s clientes conectados a esta interfaz, los atacantes pueden ejecutar comandos arbitrarios de gesti\u00f3n, obtener informaci\u00f3n sensible o provocar una denegaci\u00f3n de servicio (SIGTERM) al desencadenar acciones XMLHttpRequest en un navegador web. Esto se demuestra mediante un POST multipart/form-data en http://localhost:23000 con un comando \"signal SIGTERM\" en un elemento TEXTAREA. NOTA: El fabricante discute que esto sea una vulnerabilidad. Afirman que este es el resultado de una configuraci\u00f3n incorrecta de la instancia OpenVPN en lugar de una vulnerabilidad intr\u00ednseca; ahora advierten de forma a\u00fan m\u00e1s expl\u00edcita contra tal configuraci\u00f3n, tanto en la documentaci\u00f3n de la interfaz de gesti\u00f3n como en un mensaje runtime."
}
],
"id": "CVE-2018-7544",
"lastModified": "2024-11-21T04:12:20.183",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-16T15:29:00.247",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://blog.0xlabs.com/2018/03/openvpn-remote-information-disclosure.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-134"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-07-08 11:15
Modified
2024-11-21 09:00
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@openvpn.net | https://community.openvpn.net/openvpn/wiki/CVE-2024-24974 | Vendor Advisory | |
| security@openvpn.net | https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ | Vendor Advisory | |
| security@openvpn.net | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html | Mailing List | |
| af854a3a-2127-422b-91ae-364da2661108 | https://community.openvpn.net/openvpn/wiki/CVE-2024-24974 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html | Mailing List |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "62343D14-4C89-4E6F-9C74-46E7EEAF79CB",
"versionEndExcluding": "2.5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*",
"matchCriteriaId": "0E77CFBC-2014-4588-B77C-C34E333645A7",
"versionEndExcluding": "2.6.10",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service."
},
{
"lang": "es",
"value": "El servicio interactivo en OpenVPN 2.6.9 y versiones anteriores permite acceder remotamente al canal del servicio OpenVPN, lo que permite a un atacante remoto interactuar con el servicio interactivo privilegiado OpenVPN."
}
],
"id": "CVE-2024-24974",
"lastModified": "2024-11-21T09:00:04.127",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2024-07-08T11:15:10.103",
"references": [
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"
},
{
"source": "security@openvpn.net",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"source": "security@openvpn.net",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-24974"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html"
}
],
"sourceIdentifier": "security@openvpn.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-923"
}
],
"source": "security@openvpn.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-08-25 16:55
Modified
2025-04-12 10:46
Severity ?
Summary
Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://osvdb.org/show/osvdb/109007 | Broken Link | |
| cve@mitre.org | http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html | Exploit | |
| cve@mitre.org | http://www.exploit-db.com/exploits/34037 | Exploit | |
| cve@mitre.org | http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php | Exploit | |
| cve@mitre.org | https://github.com/CVEProject/cvelist/pull/3909 | ||
| cve@mitre.org | https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d | ||
| cve@mitre.org | https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://osvdb.org/show/osvdb/109007 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html | Exploit | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.exploit-db.com/exploits/34037 | Exploit | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php | Exploit | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/CVEProject/cvelist/pull/3909 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openvpn | openvpn | 2.1.28.0 | |
| privatetunnel | privatetunnel | 2.3.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openvpn:openvpn:2.1.28.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F249DC64-DBC5-4520-9351-224E51A21EC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:privatetunnel:privatetunnel:2.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "543391ED-92D8-439F-8B96-EE0F956C2C64",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder."
},
{
"lang": "es",
"value": "Vulnerabilidad de la ruta de b\u00fasqueda de Windows sin entrecomillar en el servicio ptservice anterior a la versi\u00f3n 3.0 de PrivateTunnel (Windows) y a la versi\u00f3n 3.1 de OpenVPN Connect (Windows) permite a los usuarios locales obtener privilegios a trav\u00e9s de un archivo program.exe en la carpeta %SYSTEMDRIVE%."
}
],
"evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/428.html\" target=\"_blank\"\u003eCWE-428: Unquoted Search Path or Element\u003c/a\u003e",
"id": "CVE-2014-5455",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-08-25T16:55:04.977",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/show/osvdb/109007"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/34037"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/CVEProject/cvelist/pull/3909"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/show/osvdb/109007"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/127439/OpenVPN-Private-Tunnel-Privilege-Escalation.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/34037"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/CVEProject/cvelist/pull/3909"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/CVEProject/cvelist/pull/3909/commits/ace34f1cf94602f31760d3eb7ae68e17df8f914d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05325943"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-428"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}