CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28882 – Ubuntu Security Notice USN-6860-1
https://notcve.org/view.php?id=CVE-2024-28882
03 Jul 2024 — OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session OpenVPN 2.6.10 y versiones anteriores en una función de servidor aceptan múltiples notificaciones de salida de clientes autenticados que extenderán la validez de una sesión de cierre Reynir Bjoernsson discovered that OpenVPN incorrectly handled terminating client connections. A remote authenticated client could possibly use this issue to keep t... • https://community.openvpn.net/openvpn/wiki/CVE-2024-28882 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7235
https://notcve.org/view.php?id=CVE-2023-7235
21 Feb 2024 — The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables. El instalador de la GUI de OpenVPN anterior a la versión 2.6.9 no establecía las restricciones de control de acceso adecuadas al directorio de instalación de los archivos binarios de OpenVPN cuando usaba una ruta de instalación no estándar, lo ... • https://community.openvpn.net/openvpn/wiki/CVE-2023-7235 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6247
https://notcve.org/view.php?id=CVE-2023-6247
20 Feb 2024 — The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing. El analizador PKCS#7 en las versiones de OpenVPN 3 Core Library hasta 3.8.3 no validó correctamente los datos analizados, lo que provocaría que la aplicación fallara. • https://community.openvpn.net/openvpn/wiki/CVE-2023-6247 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7245
https://notcve.org/view.php?id=CVE-2023-7245
20 Feb 2024 — The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable El framework nodejs en OpenVPN Connect 3.0 a 3.4.3 (Windows)/3.4.7 (macOS) no se configuró correctamente, lo que permite a un usuario local ejecutar código arbitrario dentro del contexto del proceso nodejs a través de la variable de entorno ELECTRON_RUN_AS_NODE • https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7224
https://notcve.org/view.php?id=CVE-2023-7224
08 Jan 2024 — OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable OpenVPN Connect versión 3.0 a 3.4.6 en macOS permite a los usuarios locales ejecutar código en librerías externas de terceros utilizando la variable de entorno DYLD_INSERT_LIBRARIES • https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 10.0EPSS: 5%CPEs: 5EXPL: 0CVE-2023-46850 – Ubuntu Security Notice USN-6484-1
https://notcve.org/view.php?id=CVE-2023-46850
11 Nov 2023 — Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. Use after free en OpenVPN versión 2.6.0 a 2.6.6 puede provocar un comportamiento indefinido, pérdida de búferes de memoria o ejecución remota al enviar búferes de red a un par remoto. It was discovered that OpenVPN incorrectly handled the --fragment option in certain configurations. A remote attacker could possibly use this issue to cause ... • https://community.openvpn.net/openvpn/wiki/CVE-2023-46850 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 0CVE-2023-46849 – Ubuntu Security Notice USN-6484-1
https://notcve.org/view.php?id=CVE-2023-46849
11 Nov 2023 — Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service. El uso de la opción --fragment en ciertas configuraciones de OpenVPN versión 2.6.0 a 2.6.6 permite a un atacante desencadenar un comportamiento de división por cero que podría provocar un bloqueo de la aplicación y provocar una denegación de servicio. It was discovered that OpenVPN incorrect... • https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 • CWE-369: Divide By Zero •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3761
https://notcve.org/view.php?id=CVE-2022-3761
17 Oct 2023 — OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials Las versiones de OpenVPN Connect anteriores a 3.4.0.4506 (macOS) y OpenVPN Connect anteriores a 3.4.0.3100 (Windows) permiten a atacantes intermediarios interceptar solicitudes de descarga de perfiles de configuración que contienen las credenciales de los usuarios. • https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-20813
https://notcve.org/view.php?id=CVE-2020-20813
22 Aug 2023 — Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. El componente Control Channel de OpenVPN v2.4.7 y anteriores permite a atacantes remotos provocar una denegación de servicio a través de un paquete de restablecimiento manipulado. • https://www.freebuf.com/vuls/215171.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4234
https://notcve.org/view.php?id=CVE-2021-4234
06 Jul 2022 — OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack. OpenVPN Access Server versiones 2.10 y versiones anteriores, son susceptibles de reenviar múltiples paquetes en respuesta a un paquete de reinicio enviado desde el cliente al que éste no responde de nuevo, resultando en un ataque de amplificación limitada • https://openvpn.net/vpn-server-resources/release-notes/#openvpn-access-server-2-11-0 • CWE-406: Insufficient Control of Network Message Volume (Network Amplification) •