Openvpn: Security Vulnerabilities
OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable
CVSS Score
7.8
EPSS Score
0.002
Published
2024-01-08
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
CVSS Score
7.5
EPSS Score
0.011
Published
2023-11-11
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
CVSS Score
9.8
EPSS Score
0.02
Published
2023-11-11
OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials
CVSS Score
5.9
EPSS Score
0.007
Published
2023-10-17
Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.
CVSS Score
7.5
EPSS Score
0.007
Published
2023-08-22
OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack.
CVSS Score
7.5
EPSS Score
0.008
Published
2022-07-06
The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password
CVSS Score
7.5
EPSS Score
0.008
Published
2022-07-06
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal
CVSS Score
7.5
EPSS Score
0.009
Published
2022-07-06
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
CVSS Score
9.8
EPSS Score
0.035
Published
2022-03-18
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
CVSS Score
6.1
EPSS Score
0.007
Published
2021-09-23