CVE-2024-28882: Medium severity OpenVPN OpenVPN vulnerability
Last updated 24 July 2024
Other sources
OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/openvpnto a version that resolves this vulnerability.Fixed in 2.6.11-r0 - Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.3-1+deb12u3 - Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.11-1 - Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.14-0+deb12u2Fixed in 2.6.14-1+deb13u3Fixed in 2.7.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28882?
CVE-2024-28882 has a medium severity rating due to the potential risk of session management issues.
How do I fix CVE-2024-28882?
To fix CVE-2024-28882, upgrade OpenVPN to version 2.6.12-1 or higher, or ensure you are on versions prior to 2.6.3-1.
What software is affected by CVE-2024-28882?
CVE-2024-28882 affects OpenVPN versions 2.6.0 through 2.6.10 when used in a server role.
What impacts does CVE-2024-28882 have on OpenVPN sessions?
CVE-2024-28882 allows authenticated clients to send multiple exit notifications, potentially keeping sessions open longer than intended.
Is CVE-2024-28882 exploitable?
Yes, CVE-2024-28882 is exploitable if an attacker has authenticated access to the OpenVPN server.