CVE-2024-5594

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2024-5594)

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

• SECURITY UPDATE: Improper PUSH_REPLY sanitization allows attackers to inject arbitrary data into third-party executables
  • debian/patches/CVE-2024-5594.patch: Properly handle null bytes and invalid characters in control
  • CVE-2024-5594
• UPDATE CERTIFICATES: Renew sample keys
  • debian/patches/sample-keys-renew.patch: Renew sample keys for 10 years

* SECURITY UPDATE: Improper PUSH_REPLY sanitization allows attackers
  to inject arbitrary data into third-party executables
  - debian/patches/CVE-2024-5594.patch: Properly handle null bytes
    and invalid characters in control
  - CVE-2024-5594

Control channel: refuse control channel messages with nonprintable characters in them. (CVE-2024-5594)

These are all security issues fixed in the openvpn-2.6.10-5.1 package on the GA media of openSUSE Tumbleweed.

This update for openvpn fixes the following issues:

• CVE-2024-5594: Fixed wrong handling of null bytes and invalid characters in control messages (bsc#1235147)

This update for openvpn fixes the following issues:

• CVE-2024-5594: Fixed handling of null bytes and invalid characters in control messages (bsc#1235147).

This update for openvpn fixes the following issues:

• CVE-2024-5594: Fixed handling of null bytes and invalid characters in control messages (bsc#1235147).

This update for openvpn fixes the following issues:

• CVE-2024-5594: Fixed incorrect handling of null bytes and invalid characters in control messages (bsc#1235147)

Reynir Björnsson discovered that OpenVPN incorrectly handled terminating client connections. A remote authenticated client could possibly use this issue to keep the connection active, bypassing certain security policies. This issue only affected Ubuntu 23.10, and Ubuntu 24.04 LTS. (CVE-2024-28882)

Reynir Björnsson discovered that OpenVPN incorrectly handled certain control channel messages with nonprintable characters. A remote attacker could possibly use this issue to cause OpenVPN to consume resources, or fill up log files with garbage, leading to a denial of service. (CVE-2024-5594)

It was discovered that OpenVPN did not perform proper input validation when generating a TLS key under certain configuration, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS. (CVE-2017-12166)

Reynir Björnsson discovered that OpenVPN incorrectly handled certain control channel messages with nonprintable characters. A remote attacker could possibly use this issue to cause OpenVPN to consume resources, or fill up log files with garbage, leading to a denial of service. (CVE-2024-5594)