Описание
Security update for openvpn
This update for openvpn fixes the following issues:
- CVE-2024-5594: Fixed handling of null bytes and invalid characters in control messages (bsc#1235147).
Список пакетов
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
openvpn-2.3.8-16.35.1
openvpn-auth-pam-plugin-2.3.8-16.35.1
Ссылки
- Link for SUSE-SU-2025:1053-1
- E-Mail link for SUSE-SU-2025:1053-1
- SUSE Security Ratings
- SUSE Bug 1235147
- SUSE CVE CVE-2024-5594 page
Описание
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:openvpn-2.3.8-16.35.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:openvpn-auth-pam-plugin-2.3.8-16.35.1
Ссылки
- CVE-2024-5594
- SUSE Bug 1235147