cbcvebase.
CVE-2024-5594
published 2025-01-06

CVE-2024-5594: OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending…

PriorityP354critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.82%
53.4th percentile
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Affected

13 ranges
VendorProductVersion rangeFixed in
debianopenvpn< openvpn 2.6.3-1+deb12u3 (bookworm)openvpn 2.6.3-1+deb12u3 (bookworm)
openvpnopenvpn< 2.6.112.6.11
openvpnopenvpn>= 0 < 2.5.1-3+deb11u12.5.1-3+deb11u1
openvpnopenvpn>= 0 < 2.6.3-1+deb12u32.6.3-1+deb12u3
openvpnopenvpn>= 0 < 2.6.11-12.6.11-1
openvpnopenvpn>= 0 < 2.6.11-12.6.11-1
openvpnopenvpn>= 0 < 2.4.12-0ubuntu0.20.04.22.4.12-0ubuntu0.20.04.2
openvpnopenvpn>= 0 < 2.5.9-0ubuntu0.22.04.32.5.9-0ubuntu0.22.04.3
openvpnopenvpn>= 0 < 2.6.9-1ubuntu4.12.6.9-1ubuntu4.1
openvpnopenvpn>= 0 < 2.3.2-7ubuntu3.2+esm22.3.2-7ubuntu3.2+esm2
openvpnopenvpn>= 0 < 2.3.10-1ubuntu2.2+esm22.3.10-1ubuntu2.2+esm2
openvpnopenvpn>= 0 < 2.4.4-2ubuntu1.7+esm12.4.4-2ubuntu1.7+esm1
openvpnopenvpn>= 2.6.0 < 2.6.112.6.11

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian9.1CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.