Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2024-5594

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OpenVPN

Description

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenVPN OpenVPN

Default version status: unaffected

  • 0 to < 2.6.11affected

References