{"id":"CVE-2024-28882","aliases":["ALPINE-CVE-2024-28882","DEBIAN-CVE-2024-28882","EUVD-2024-25951","GHSA-v34q-j8xh-hjgx","OESA-2024-1840","SUSE-SU-2024:3502-1","SUSE-SU-2024:3532-1","UBUNTU-CVE-2024-28882","USN-6860-1","openSUSE-SU-2024:14436-1"],"status":"published","title":"OpenVPN 2.6.10 and earlier in a server role accepts multiple exit notifications from...","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00665,"percentile":0.52075,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2024-06-25T00:00:00Z","modified":"2026-11-02T12:01:31Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openvpn","fixed_in":["2.6.3-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openvpn","fixed_in":["2.6.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openvpn","fixed_in":["2.6.11-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"openvpn","fixed_in":["2.5.5-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"openvpn","fixed_in":["2.5.5-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"openvpn","fixed_in":["2.5.5-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"openvpn","fixed_in":["2.4.8-9.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openvpn","fixed_in":["2.6.9-2.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openvpn","fixed_in":["2.6.8-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openvpn","fixed_in":["2.6.8-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openvpn","fixed_in":["2.3.8-16.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openvpn","fixed_in":["2.3.8-16.32.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openvpn","fixed_in":["2.6.9-1ubuntu4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openvpn","fixed_in":["2.6.10-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1+deb12u3"}]}],"versions":["2.6.3-1","2.6.3-1+deb12u1","2.6.3-1+deb12u1~bpo11+1","2.6.3-1+deb12u2","2.6.3-1+deb12u2~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.11-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-9.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9-2.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.8-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.8-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.32.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9-1ubuntu4.1"}]}],"versions":["2.6.5-0ubuntu1","2.6.7-1ubuntu1","2.6.9-1ubuntu2","2.6.9-1ubuntu3","2.6.9-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12-0ubuntu0.20.04.2"}]}],"versions":["2.4.7-1ubuntu2","2.4.7-1ubuntu2.20.04.2","2.4.7-1ubuntu2.20.04.3","2.4.7-1ubuntu2.20.04.4","2.4.12-0ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-0ubuntu0.22.04.3"}]}],"versions":["2.5.1-3ubuntu1","2.5.1-3ubuntu2","2.5.1-3ubuntu4","2.5.1-3ubuntu5","2.5.5-1ubuntu1","2.5.5-1ubuntu3","2.5.5-1ubuntu3.1","2.5.9-0ubuntu0.22.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9-1ubuntu4.1"}]}],"versions":["2.6.5-0ubuntu1","2.6.7-1ubuntu1","2.6.9-1ubuntu2","2.6.9-1ubuntu3","2.6.9-1ubuntu4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.10-2.1"}]}]}],"products":[{"vendor":"openvpn","product":"openvpn"}],"references":[{"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-28882","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html","tags":["x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28882","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v34q-j8xh-hjgx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-28882","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28882.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28882","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1840","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243502-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227546","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28882","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243532-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28882","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28882","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6860-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-5594","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KIPA7OBR5EVC3PIBCIJICJKK7MH3RBNA/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-28882","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-07-08T21:30:24.798Z","modified":"2024-11-01T20:38:32.966Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-25951","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-07-08T21:30:24Z","modified":"2024-11-01T20:38:32Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:05:12.213578Z"}],"ghsa":[{"id":"GHSA-v34q-j8xh-hjgx","title":"OpenVPN 2.6.10 and earlier in a server role accepts multiple exit notifications from...","description":"OpenVPN 2.6.10 and earlier in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-07-09T00:31:40Z","modified":"2024-11-02T00:37:22Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:58:42.644546Z"}],"nvd":[{"id":"CVE-2024-28882","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-07-08T22:15:02.41Z","modified":"2026-06-17T07:21:57.75Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"ALPINE-CVE-2024-28882","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-07-08T22:15:02.41Z","modified":"2026-11-02T11:17:50.086309119Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2024-28882","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-07-08T21:30:24.798Z","modified":"2026-10-28T02:30:42.453634573Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-28882","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-07-08T22:15:02.41Z","modified":"2026-11-02T12:01:31.565333178Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"OESA-2024-1840","title":"openvpn security update","description":"OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations,  including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing,  failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security,  OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.\n\nSecurity Fix(es):\n\nOpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session(CVE-2024-28882)","status":"published","published":"2024-07-12T11:07:18Z","modified":"2026-08-18T01:18:28.994889204Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-28882","description":"OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session","status":"published","published":"2024-06-25T00:00:00Z","modified":"2026-02-04T02:27:25.558414Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"openSUSE-SU-2024:14436-1","title":"openvpn-2.6.10-2.1 on GA media","description":"These are all security issues fixed in the openvpn-2.6.10-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2025-05-07T18:15:59.499948Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:3502-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2024-28882: Fix multiple exit notifications from authenticated clients will extend the validity of a closing session (bsc#1227546) \n","status":"published","published":"2024-10-01T14:03:50Z","modified":"2026-02-04T04:32:11.52837Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3532-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2024-28882: Fix multiple exit notifications from authenticated clients will extend the validity of a closing session (bsc#1227546) \n","status":"published","published":"2024-10-04T14:29:54Z","modified":"2026-02-04T04:16:02.382794Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-6860-1","title":"openvpn vulnerabilities","description":"Reynir Björnsson discovered that OpenVPN incorrectly handled terminating\nclient connections. A remote authenticated client could possibly use this\nissue to keep the connection active, bypassing certain security policies.\nThis issue only affected Ubuntu 23.10, and Ubuntu 24.04 LTS.\n(CVE-2024-28882)\n\nReynir Björnsson discovered that OpenVPN incorrectly handled certain\ncontrol channel messages with nonprintable characters. A remote attacker\ncould possibly use this issue to cause OpenVPN to consume resources, or\nfill up log files with garbage, leading to a denial of service.\n(CVE-2024-5594)\n","status":"published","published":"2024-07-02T13:44:50Z","modified":"2026-02-10T04:44:20Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}