3 ms·

Critical OpenVPN Zero-Day Flaws

• dspillett 3y ago
  Appologies - that article looks rather LLM generated and lacking in useful detail, https://www.blackhat.com/us-24/briefings/schedule/#ovpnx--zero-days-leading-to-rce-lpe-and-kce-via-byovd-affecting-millions-of-openvpn-endpoints-across-the-globe-38900 https://www.blackhat.com/us-24/briefings/schedule/#ovpnx--ze... is a much better direct link.
• mdtancsa 3y ago
  Any discussion around this with more details ? I was surprised nothing mentioned on the OpenVPN list
  • popoypatalo 3y ago
    Is this vulnerability only impacts OpenVPN access server or it also impacts their OpenVPN connect client vpn?
    • mdtancsa 3y ago
      These were from a while ago but the article implied they were new which they are not. Details at https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst
      • popoypatalo 3y ago
        thanks. saw that too. seems this is being repackaged as a zero day. https://www.reddit.com/r/OpenVPN/s/1qrqJhp0Fp https://www.reddit.com/r/OpenVPN/s/1qrqJhp0Fp
• mdtancsa 3y ago
  these were from March ?!? https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst
• deleted 3y ago
  [deleted]