AIKIDO-2025-10404
OpenVPN.openvpn is vulnerable to Improper Validation of Specified Type of Input
24
Low Risk
This Affects:
OpenVPN.openvpnTL;DR
Affected versions of OpenVPN prior to 2.6.11 do not properly sanitize PUSH_REPLY messages, allowing a malicious server to inject unexpected and arbitrary data that may be written to client logs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
OpenVPN.openvpn is vulnerable to Improper Validation of Specified Type of Input in versions 2.5.0 - 2.5.10 and 2.6.0 - 2.6.11.
How to fix this
Upgrade the OpenVPN.openvpn library to the patch version.
Links
GitHub Release
Other
community.openvpn.net/openvpn/wiki/CVE-2024-5594mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.htmllists.debian.org/debian-lts-announce/2025/03/msg00005.html
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.