Описание
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| openvpn | fixed | 2.6.7-1 | package | |
| openvpn | not-affected | bullseye | package | |
| openvpn | not-affected | buster | package |
Примечания
https://community.openvpn.net/openvpn/wiki/CVE-2023-46850
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
Introduced by: https://github.com/OpenVPN/openvpn/commit/9a7b95fda56127df6de6fe7c60e08fb5b67a9919 (v2.6_beta1)
Fixed by: https://github.com/OpenVPN/openvpn/commit/57a5cd1e12f193927c9b7429f8778fec7e04c50a (v2.6.7)
EPSS
Связанные уязвимости
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
Уязвимость программного обеспечения OpenVPN, связанная с использованием памяти после её освобождения, позволяющая нарушителю вызвать отказ в обслуживании
EPSS