FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-02-02 08:34:31 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
47bc292a-d472-11ef-aaab-7d43732cb6f5openvpn -- too long a username or password from a client can confuse openvpn servers

Frank Lichtenheld reports:

[OpenVPN v2.6.13 ...] improve server-side handling of clients sending usernames or passwords longer than USER_PASS_LEN - this would not result in a crash, buffer overflow or other security issues, but the server would then misparse incoming IV variables and produce misleading error messages.


Discovery 2024-10-28
Entry 2025-01-17
openvpn
< 2.6.13

https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13
142c538e-b18f-40a1-afac-c479effadd5copenvpn -- two security fixes

Gert Doering reports that OpenVPN 2.6.11 fixes two security bugs (three on Windows):

CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. (Reynir Björnsson)

CVE-2024-28882: only call schedule_exit() once (on a given peer). Security scope: an authenticated client can make the server "keep the session" even when the server has been told to disconnect this client. (Reynir Björnsson)


Discovery 2024-05-16
Entry 2024-06-20
openvpn
< 2.6.11

CVE-2024-5594
CVE-2024-28882
https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst#security-fixes