Summary
It was discovered that OpenVPN did not perform proper input validation
when generating a TLS key under certain configuration, which could lead to
a buffer overflow. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS. (CVE-2017-12166)
Reynir Björnsson discovered that OpenVPN incorrectly handled certain
control channel messages with nonprintable characters. A remote attacker
could possibly use this issue to cause OpenVPN to consume resources, or
fill up log files with garbage, leading to a denial of service.
(CVE-2024-5594)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | openvpn | 2.3.2-7ubuntu3.2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | openvpn | 2.3.10-1ubuntu2.2+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | openvpn | 2.4.4-2ubuntu1.7+esm1 |
Vulnerabilities 2
-
Critical 9.1
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to…
-
Unscored —
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method …