Openvpn vulnerabilities, page 3
98 vulnerabilities
Known vulnerabilities in Openvpn products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.
CVE-2005-2534debianopenvpn+1
EPSS score0.97%
Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate.CVE-2005-2533debianopenvpn+1EPSS score0.68%
OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses.CVE-2005-3393debianopenvpn+2EPSS score3.48%
Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option.CVE-2005-3409debianopenvpn+2EPSS score2.50%
OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.CVE-2008-3459debianopenvpn+1EPSS score2.12%
Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.CVE-2022-0547alpineopenvpn+45EPSS score3.57%
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.CVE-2022-3761openvpn incopenvpn connect+1EPSS score0.84%
OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentialsCVE-2022-33737openvpnopenvpn_access_serverEPSS score0.87%
The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin passwordCVE-2022-33738openvpnopenvpn_access_serverEPSS score0.92%
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portalCVE-2017-7508debianopenvpn+8EPSS score4.76%
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.CVE-2017-7479alpineopenvpn+4EPSS score1.85%
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.CVE-2017-7478alpineopenvpn+3EPSS score13.78%
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.CVE-2017-7522debianopenvpn+3EPSS score5.54%
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.CVE-2017-7520debianopenvpn+3EPSS score3.38%
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.CVE-2017-7521debianopenvpn+3EPSS score3.85%
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().CVE-2017-5868openvpnopenvpn_access_serverEPSS score4.62%
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.CVE-2017-12166debianopenvpn+17EPSS score3.63%
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.CVE-2024-13454debianeasy-rsa+2EPSS score0.08%
Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3CVE-2024-1305openvpnopenvpn-gui+1EPSS score15.38%
tap-windows6 driver version 9.26 and earlier does not properly
check the size data of incomming write operations which an attacker can
use to overflow memory buffers, resulting in a bug check and potentially
arbitrary code execution in kernel spaceCVE-2024-4877alpineopenvpn+1EPSS score0.43%
OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges