USN-8953-1: OpenVPN vulnerability
Published Oct 22, 2026
·Updated
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Affected Software
9 affected componentsFixes available
OpenVPN OpenVPN
All of the following
ubuntu/openvpn<2.7.7-1ubuntu1.1
2.7.7-1ubuntu1.1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/openvpn<2.7.0-1ubuntu1.4
2.7.0-1ubuntu1.4
Ubuntu Ubuntu=26.04
All of the following
ubuntu/openvpn<2.6.19-0ubuntu0.24.04.5
2.6.19-0ubuntu0.24.04.5
Ubuntu Ubuntu=24.04
All of the following
ubuntu/openvpn<2.5.11-0ubuntu0.22.04.6
2.5.11-0ubuntu0.22.04.6
Ubuntu Ubuntu=22.04
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openvpnto a version that resolves this vulnerability.Fixed in 2.7.7-1ubuntu1.1 - Upgrade
Upgrade
ubuntu/openvpnto a version that resolves this vulnerability.Fixed in 2.7.0-1ubuntu1.4 - Upgrade
Upgrade
ubuntu/openvpnto a version that resolves this vulnerability.Fixed in 2.6.19-0ubuntu0.24.04.5 - Upgrade
Upgrade
ubuntu/openvpnto a version that resolves this vulnerability.Fixed in 2.5.11-0ubuntu0.22.04.6
Event History
Oct 22, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software