{"id":"CVE-2024-5594","aliases":["ALPINE-CVE-2024-5594","CLSA-2025-1744710425","CLSA-2025-1744727573","DEBIAN-CVE-2024-5594","DLA-4079-1","EUVD-2024-47154","GHSA-f2h8-4w6p-535w","MGASA-2024-0255","OESA-2024-1885","SUSE-SU-2025:0278-1","SUSE-SU-2025:1053-1","SUSE-SU-2025:1053-2","SUSE-SU-2025:1131-1","UBUNTU-CVE-2024-5594","USN-6860-1","USN-7340-1","openSUSE-SU-2025:14707-1"],"status":"published","title":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to...","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00817,"percentile":0.57405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1287"],"published":"2024-06-25T00:00:00Z","modified":"2026-11-02T12:03:02Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"openvpn","fixed_in":["2.5.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openvpn","fixed_in":["2.6.11-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"openvpn","fixed_in":["2.4.4-2ubuntu1.7+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"openvpn","fixed_in":["2.3.10-1ubuntu2.2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openvpn","fixed_in":["2.6.3-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openvpn","fixed_in":["2.6.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openvpn","fixed_in":["2.6.11-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"openvpn","fixed_in":["2.5.9-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"openvpn","fixed_in":["2.5.5-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"openvpn","fixed_in":["2.4.8-10.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"openvpn","fixed_in":["2.5.5-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openvpn","fixed_in":["2.6.9-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"openvpn","fixed_in":["2.5.5-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openvpn","fixed_in":["2.6.8-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openvpn-dco","fixed_in":["2.6.8-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openvpn","fixed_in":["2.6.8-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openvpn-dco","fixed_in":["2.6.8-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openvpn","fixed_in":["2.3.8-16.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openvpn","fixed_in":["2.3.8-16.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"openvpn","fixed_in":["2.5.6-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openvpn","fixed_in":["2.3.2-7ubuntu3.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openvpn","fixed_in":["2.3.10-1ubuntu2.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openvpn","fixed_in":["2.4.4-2ubuntu1.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"openvpn","fixed_in":["2.4.12-0ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openvpn","fixed_in":["2.5.9-0ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openvpn","fixed_in":["2.6.9-1ubuntu4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openvpn","fixed_in":["2.6.10-5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.5.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.11-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu1.7+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1ubuntu2.2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1+deb12u3"}]}],"versions":["2.6.3-1","2.6.3-1+deb12u1","2.6.3-1+deb12u1~bpo11+1","2.6.3-1+deb12u2","2.6.3-1+deb12u2~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.11-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-3+deb11u1"}]}],"versions":["2.5.1-3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-10.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.8-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openvpn-dco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.8-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.8-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openvpn-dco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.8-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-16.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-7ubuntu3.2+esm2"}]}],"versions":["2.3.2-4ubuntu1","2.3.2-5ubuntu1","2.3.2-7ubuntu1","2.3.2-7ubuntu2","2.3.2-7ubuntu3","2.3.2-7ubuntu3.1","2.3.2-7ubuntu3.2","2.3.2-7ubuntu3.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1ubuntu2.2+esm2"}]}],"versions":["2.3.7-1ubuntu1","2.3.7-2ubuntu1","2.3.8-1ubuntu1","2.3.10-1ubuntu1","2.3.10-1ubuntu2","2.3.10-1ubuntu2.1","2.3.10-1ubuntu2.2","2.3.10-1ubuntu2.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu1.7+esm1"}]}],"versions":["2.4.3-4ubuntu1","2.4.4-1ubuntu1","2.4.4-2ubuntu1","2.4.4-2ubuntu1.1","2.4.4-2ubuntu1.2","2.4.4-2ubuntu1.3","2.4.4-2ubuntu1.5","2.4.4-2ubuntu1.6","2.4.4-2ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12-0ubuntu0.20.04.2"}]}],"versions":["2.4.7-1ubuntu2","2.4.7-1ubuntu2.20.04.2","2.4.7-1ubuntu2.20.04.3","2.4.7-1ubuntu2.20.04.4","2.4.12-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-0ubuntu0.22.04.3"}]}],"versions":["2.5.1-3ubuntu1","2.5.1-3ubuntu2","2.5.1-3ubuntu4","2.5.1-3ubuntu5","2.5.5-1ubuntu1","2.5.5-1ubuntu3","2.5.5-1ubuntu3.1","2.5.9-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9-1ubuntu4.1"}]}],"versions":["2.6.5-0ubuntu1","2.6.7-1ubuntu1","2.6.9-1ubuntu2","2.6.9-1ubuntu3","2.6.9-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12-0ubuntu0.20.04.2"}]}],"versions":["2.4.7-1ubuntu2","2.4.7-1ubuntu2.20.04.2","2.4.7-1ubuntu2.20.04.3","2.4.7-1ubuntu2.20.04.4","2.4.12-0ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-0ubuntu0.22.04.3"}]}],"versions":["2.5.1-3ubuntu1","2.5.1-3ubuntu2","2.5.1-3ubuntu4","2.5.1-3ubuntu5","2.5.5-1ubuntu1","2.5.5-1ubuntu3","2.5.5-1ubuntu3.1","2.5.9-0ubuntu0.22.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9-1ubuntu4.1"}]}],"versions":["2.6.5-0ubuntu1","2.6.7-1ubuntu1","2.6.9-1ubuntu2","2.6.9-1ubuntu3","2.6.9-1ubuntu4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-7ubuntu3.2+esm2"}]}],"versions":["2.3.2-4ubuntu1","2.3.2-5ubuntu1","2.3.2-7ubuntu1","2.3.2-7ubuntu2","2.3.2-7ubuntu3","2.3.2-7ubuntu3.1","2.3.2-7ubuntu3.2","2.3.2-7ubuntu3.2+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10-1ubuntu2.2+esm2"}]}],"versions":["2.3.7-1ubuntu1","2.3.7-2ubuntu1","2.3.8-1ubuntu1","2.3.10-1ubuntu1","2.3.10-1ubuntu2","2.3.10-1ubuntu2.1","2.3.10-1ubuntu2.2","2.3.10-1ubuntu2.2+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu1.7+esm1"}]}],"versions":["2.4.3-4ubuntu1","2.4.4-1ubuntu1","2.4.4-2ubuntu1","2.4.4-2ubuntu1.1","2.4.4-2ubuntu1.2","2.4.4-2ubuntu1.3","2.4.4-2ubuntu1.5","2.4.4-2ubuntu1.6","2.4.4-2ubuntu1.7"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openvpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.10-5.1"}]}]}],"products":[{"vendor":"openvpn","product":"openvpn"}],"references":[{"url":"https://community.openvpn.net/openvpn/wiki/CVE-2024-5594","tags":["Vendor Advisory","web"]},{"url":"https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html","tags":["Release Notes","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5594","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f2h8-4w6p-535w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-5594","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1744710425.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2025-1744727573.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5594.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-5594","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0255.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33336","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G2MRELY2ZT6N3PIJHLUCNPCY5GA5EDDU/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-6860-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1885","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250278-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235147","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5594","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251053-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251053-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251131-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-5594","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5594","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7340-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12166","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4OGKNXNQUPJ2676MEOZA32KDCGPJ5OV7/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-5594","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","status":"published","published":"2025-01-06T13:52:20.272Z","modified":"2025-11-03T20:48:53.705Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:34:00.929382Z"}],"euvd":[{"id":"EUVD-2024-47154","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","status":"published","published":"2025-01-06T13:52:20Z","modified":"2025-11-03T20:48:53Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:49:32.126029Z"}],"ghsa":[{"id":"GHSA-f2h8-4w6p-535w","title":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to...","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to inject unexpected arbitrary data into third-party executables or plug-ins.","status":"published","published":"2025-01-06T15:31:00Z","modified":"2025-11-03T21:32:03Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T15:04:19.844682Z"}],"nvd":[{"id":"CVE-2024-5594","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","status":"published","published":"2025-01-06T14:15:08.807Z","modified":"2026-06-17T08:16:15.38Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:10:41.489236Z"}],"osv":[{"id":"ALPINE-CVE-2024-5594","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","status":"published","published":"2025-01-06T14:15:08.807Z","modified":"2026-11-02T11:17:50.129550017Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2024-5594","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","status":"published","published":"2025-01-06T13:52:20.272Z","modified":"2026-10-28T02:31:03.57340422Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"DEBIAN-CVE-2024-5594","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","status":"published","published":"2025-01-06T14:15:08.807Z","modified":"2026-11-02T12:03:02.622931766Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"OESA-2024-1885","title":"openvpn security update","description":"OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations,  including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing,  failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security,  OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.\n\nSecurity Fix(es):\n\n(CVE-2024-5594)","status":"published","published":"2024-07-26T11:07:21Z","modified":"2026-08-18T01:18:30.551975594Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-5594","description":"OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.","status":"published","published":"2024-06-25T00:00:00Z","modified":"2026-02-04T04:26:45.706409Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:55:15.331356Z"},{"id":"CLSA-2025-1744710425","title":"Fix CVE(s): CVE-2024-5594","description":"   * SECURITY UPDATE: Improper PUSH_REPLY sanitization allows attackers\n     to inject arbitrary data into third-party executables\n     - debian/patches/CVE-2024-5594.patch: Properly handle null bytes\n       and invalid characters in control\n     - CVE-2024-5594\n   * UPDATE CERTIFICATES: Renew sample keys\n     - debian/patches/sample-keys-renew.patch: Renew sample keys for 10 years","status":"published","published":"2025-04-15T14:17:48Z","modified":"2026-06-04T10:03:16.466357Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1744727573","title":"Fix CVE(s): CVE-2024-5594","description":"    * SECURITY UPDATE: Improper PUSH_REPLY sanitization allows attackers\n      to inject arbitrary data into third-party executables\n      - debian/patches/CVE-2024-5594.patch: Properly handle null bytes\n        and invalid characters in control\n      - CVE-2024-5594","status":"published","published":"2025-04-15T14:32:58Z","modified":"2026-06-04T10:03:35.607163Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DLA-4079-1","title":"openvpn - security update","status":"published","published":"2025-03-08T00:00:00Z","modified":"2026-03-09T01:17:55.178456Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0255","title":"Updated openvpn packages fix security vulnerability","description":"Control channel: refuse control channel messages with nonprintable\ncharacters in them. (CVE-2024-5594)\n","status":"published","published":"2024-07-04T16:48:09Z","modified":"2026-04-16T04:44:06.031360651Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:14707-1","title":"openvpn-2.6.10-5.1 on GA media","description":"These are all security issues fixed in the openvpn-2.6.10-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-28T00:00:00Z","modified":"2026-02-04T03:39:46.805246Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0278-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2024-5594: Fixed wrong handling of null bytes and invalid characters in control messages (bsc#1235147)\n","status":"published","published":"2025-01-28T23:46:43Z","modified":"2026-02-04T02:28:35.262176Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:1053-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2024-5594: Fixed handling of null bytes and invalid characters in control messages (bsc#1235147).\n","status":"published","published":"2025-03-28T16:46:40Z","modified":"2026-02-04T03:39:58.637336Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1053-2","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2024-5594: Fixed handling of null bytes and invalid characters in control messages (bsc#1235147).\n","status":"published","published":"2025-04-01T12:04:36Z","modified":"2026-02-04T02:19:54.414984Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1131-1","title":"Security update for openvpn","description":"This update for openvpn fixes the following issues:\n\n- CVE-2024-5594: Fixed incorrect handling of  null bytes and invalid characters in control messages (bsc#1235147)\n","status":"published","published":"2025-04-03T13:10:01Z","modified":"2026-02-04T03:17:09.882335Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6860-1","title":"openvpn vulnerabilities","description":"Reynir Björnsson discovered that OpenVPN incorrectly handled terminating\nclient connections. A remote authenticated client could possibly use this\nissue to keep the connection active, bypassing certain security policies.\nThis issue only affected Ubuntu 23.10, and Ubuntu 24.04 LTS.\n(CVE-2024-28882)\n\nReynir Björnsson discovered that OpenVPN incorrectly handled certain\ncontrol channel messages with nonprintable characters. A remote attacker\ncould possibly use this issue to cause OpenVPN to consume resources, or\nfill up log files with garbage, leading to a denial of service.\n(CVE-2024-5594)\n","status":"published","published":"2024-07-02T13:44:50Z","modified":"2026-02-10T04:44:20Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-7340-1","title":"openvpn vulnerabilities","description":"It was discovered that OpenVPN did not perform proper input validation\nwhen generating a TLS key under certain configuration, which could lead to\na buffer overflow. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS. (CVE-2017-12166)\n\nReynir Björnsson discovered that OpenVPN incorrectly handled certain\ncontrol channel messages with nonprintable characters. A remote attacker\ncould possibly use this issue to cause OpenVPN to consume resources, or\nfill up log files with garbage, leading to a denial of service.\n(CVE-2024-5594)\n","status":"published","published":"2025-03-11T03:13:12Z","modified":"2026-06-25T13:31:46.020612429Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}