A vulnerability in OpenVPN allows data substitution in plugins and third-party handlers.
Information has been revealed about a vulnerability (CVE-2024-5594) in the OpenVPN package for creating virtual private networks, which can lead to arbitrary data being injected into third-party executable files or plugins in the system on the other side of the connection. The vulnerability is caused by the lack of checking for null bytes and invalid characters when processing control messages such as PUSH_REPLY. The issue has been resolved in OpenVPN versions 2.5.11 […]
