CVE-2024-5594

Description

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to inject unexpected arbitrary data into third-party executables or plug-ins.

Reserved 2024-06-03 | Published 2025-01-06 | Updated 2025-01-06 | Assigner OpenVPN

Problem types

Improper Validation of Specified Type of Input

Product status

Default status
unaffected

Any version before 2.6.11
affected

References

community.openvpn.net/openvpn/wiki/CVE-2024-5594

www.mail-archive.com/...@lists.sourceforge.net/msg07634.html

cve.org (CVE-2024-5594)

nvd.nist.gov (CVE-2024-5594)

Download JSON