CVE-2024-5594

Description

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to inject unexpected arbitrary data into third-party executables or plug-ins.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-02

https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-06

https://tuxcare.com/blog/ubuntu-fixes-two-openvpn-vulnerabilities/

https://www.mail-archive.com/[email protected]/msg07634.html

https://community.openvpn.net/openvpn/wiki/CVE-2024-5594

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3