CVE-2024-28882 — Missing Release of Resource after Effective Lifetime in Openvpn

CWE-772 — Missing Release of Resource after Effective Lifetime10 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 42.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OpenvpnDebian Openvpn
Timeline
PublishedJul 8
Latest updateMar 13

Description

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶debiandebian/openvpn< openvpn 2.6.3-1+deb12u3 (bookworm)
▶NVDopenvpn/openvpn2.6.0 — 2.6.11
▶Debianopenvpn/openvpn< 2.6.3-1+deb12u3+2
▶Ubuntuopenvpn/openvpn< 2.4.12-0ubuntu0.20.04.2+2
▶CVEListV5openvpn/openvpn2.6.0 — 2.6.10

🔴Vulnerability Details

4
GHSA
GHSA-v34q-j8xh-hjgx: OpenVPN 2↗2024-07-09
▶
CVEList
CVE-2024-28882: OpenVPN from 2↗2024-07-08
▶
OSV
CVE-2024-28882: OpenVPN from 2↗2024-07-08
▶
OSV
openvpn vulnerabilities↗2024-07-02
▶

📋Vendor Advisories

5
CISA ICS
Siemens SINEMA Remote Connect Client↗2025-03-13
▶
CISA ICS
Siemens SINEMA Remote Connect Server↗2025-03-13
▶
CISA ICS
Siemens SCALANCE M-800 Family↗2024-11-14
▶
Ubuntu
OpenVPN vulnerabilities↗2024-07-02
▶
Debian
CVE-2024-28882: openvpn - OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notific...↗2024
▶