ALT-PU-2024-10684-1

Обновление пакета openvpn в ветке sisyphus_riscv64

Версия2.6.12-alt1

Задание#0

Опубликовано2024-08-02

Макс. серьёзностьCRITICAL

Серьёзность:

Закрытые проблемы (3)

MEDIUM4.3

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

Опубликовано: 2024-07-08Изменено: 2025-06-10

CVSS 3.xСРЕДНЯЯ 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Ссылки

HIGH8.8

OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges

Опубликовано: 2025-04-03Изменено: 2025-04-29

CVSS 3.xВЫСОКАЯ 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ссылки

CRITICAL9.1

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Опубликовано: 2025-01-06Изменено: 2025-11-03

CVSS 3.xКРИТИЧЕСКАЯ 9.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Ссылки