CVE-2021-3613
First published: Fri Jul 02 2021(Updated: )
OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe).
Credit: security@openvpn.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openvpn Connect | >=3.2.0<=3.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this OpenVPN Connect vulnerability?
The vulnerability ID is CVE-2021-3613.
What is the severity rating of CVE-2021-3613?
CVE-2021-3613 has a severity rating of 7.8 (high).
How does CVE-2021-3613 impact OpenVPN Connect?
CVE-2021-3613 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file, potentially allowing the execution of arbitrary code with the same privilege level as the main OpenVPN process.
Which versions of OpenVPN Connect are affected by CVE-2021-3613?
OpenVPN Connect versions 3.2.0 through 3.3.0 are affected by CVE-2021-3613.
Is there a fix available for CVE-2021-3613?
To fix CVE-2021-3613, users should update to a version of OpenVPN Connect that is not affected by the vulnerability.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/event
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/openvpn
- canonical/openvpn connect
- version/openvpn connect/3.2.0
- version/openvpn connect/3.3.0