Search for packages
| purl | pkg:deb/debian/openvpn@2.4.7-1%2Bdeb10u1 |
| Next non-vulnerable version | 2.6.3-1+deb12u4 |
| Latest non-vulnerable version | 2.6.3-1+deb12u4 |
| Risk | 4.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-69y7-qv5p-gqar
Aliases: CVE-2020-11810 |
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use. |
Affected by 2 other vulnerabilities. |
|
VCID-faqk-wzr3-77be
Aliases: CVE-2022-0547 |
Multiple vulnerabilities have been discovered in OpenVPN, the worst of which could lead to information disclosure. |
Affected by 0 other vulnerabilities. |
|
VCID-htt5-x61p-2qar
Aliases: CVE-2024-5594 |
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs. |
Affected by 0 other vulnerabilities. |
|
VCID-j1d4-djxq-dqct
Aliases: CVE-2020-15078 |
A vulnerability has been found in OpenVPN, allowing attackers to bypass the authentication process. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-n8nh-wf64-8fgr | security update |
CVE-2017-7508
|
| VCID-rkee-udq8-afg2 | openvpn: Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17 |
CVE-2017-7522
|
| VCID-ruzb-y7qd-nfgc | OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution. |
CVE-2017-12166
|
| VCID-vucu-2pfy-93ds | security update |
CVE-2017-7521
|
| VCID-zuyu-zw1g-uqg7 | security update |
CVE-2017-7520
|