CVE-2024-28882: Medium severity openvpn monitor vulnerability
Published Jul 8, 2024
·Updated
Last updated 24 July 2024
Other sources
OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session
— NVD
Affected Software
2 affected componentsFixes available
debian/openvpn<=2.6.3-1+deb12u2
2.5.1-32.5.1-3+deb11u12.6.13-12.6.14-1
OpenVPN OpenVPN>=2.6.0<2.6.11
Remediation
Event History
Jul 8, 2024
CVE Published
via MITRE·09:30 PM
Data Sourced
via MITRE·09:30 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeakness
Sep 16, 2024
Data Sourced
via Ubuntu·10:19 PM
RemedyDescriptionSeverityAffected Software
Mar 11, 2025
Data Sourced
via Debian·04:34 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-28882?
CVE-2024-28882 has a medium severity rating due to the potential risk of session management issues.
2
How do I fix CVE-2024-28882?
To fix CVE-2024-28882, upgrade OpenVPN to version 2.6.12-1 or higher, or ensure you are on versions prior to 2.6.3-1.
3
What software is affected by CVE-2024-28882?
CVE-2024-28882 affects OpenVPN versions 2.6.0 through 2.6.10 when used in a server role.
4
What impacts does CVE-2024-28882 have on OpenVPN sessions?
CVE-2024-28882 allows authenticated clients to send multiple exit notifications, potentially keeping sessions open longer than intended.
5
Is CVE-2024-28882 exploitable?
Yes, CVE-2024-28882 is exploitable if an attacker has authenticated access to the OpenVPN server.