Summary
It was discovered that OpenVPN incorrectly handled certificate subject
fields. A remote authenticated user could possibly use this issue to
impersonate other users.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | openvpn | 2.5.11-0ubuntu0.22.04.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | openvpn | 2.6.19-0ubuntu0.24.04.5 |
| Ubuntu · 26.04 LTS 26.04:LTS | openvpn | 2.7.0-1ubuntu1.4 |
| Ubuntu · 26.10 | openvpn | 2.7.7-1ubuntu1.1 |
Vulnerabilities 1
-
High 7.6
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subj…
References
-
report
https://ubuntu.com/security/CVE-2026-84790