Resource management error in OpenVPN for Windows - CVE-2024-28882

Vulnerability identifier: #VU92938

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-28882

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. A remote authenticated client can make the server "keep the session" even when the server has been told to disconnect this client.

OpenVPN for Windows
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
openvpn-debugsource
openvpn-auth-pam-plugin
openvpn-debuginfo
openvpn-auth-pam-plugin-debuginfo
openvpn
openvpn (Ubuntu package)
openvpn-devel
openvpn-help
openvpn-down-root-plugin
openvpn-down-root-plugin-debuginfo
SINEMA Remote Connect Client
SINEMA Remote Connect Server

Install updates from vendor's website.

OpenVPN for Windows - update to 2.6.11
openvpn-debugsource - addressed in versions 2.3.8-16.32.1, 2.6.8-150600.3.3.1
openvpn-auth-pam-plugin - addressed in versions 2.3.8-16.32.1, 2.6.8-150600.3.3.1
openvpn-debuginfo - addressed in versions 2.3.8-16.32.1, 2.6.8-150600.3.3.1
openvpn-auth-pam-plugin-debuginfo - addressed in versions 2.3.8-16.32.1, 2.6.8-150600.3.3.1
openvpn - addressed in versions 2.3.8-16.32.1, 2.6.8-150600.3.3.1
openvpn (Ubuntu package) - addressed in versions 2.4.12-0ubuntu0.20.04.2, 2.5.9-0ubuntu0.22.04.3, 2.6.5-0ubuntu1.2, 2.6.9-1ubuntu4.1
openvpn-debuginfo - update to 2.5.5-3
openvpn-debugsource - update to 2.5.5-3
openvpn-devel - update to 2.5.5-3
openvpn-help - update to 2.5.5-3
openvpn - update to 2.5.5-3
openvpn-devel - update to 2.6.8-150600.3.3.1
openvpn-down-root-plugin - update to 2.6.8-150600.3.3.1
openvpn-down-root-plugin-debuginfo - update to 2.6.8-150600.3.3.1
openvpn - update to 2.6.11-1.fc40
SINEMA Remote Connect Client - update to 3.2 SP3
SINEMA Remote Connect Server - update to 3.2 SP3

• https://github.com/OpenVPN/openvpn/releases/tag/v2.6.11

• Multiple vulnerabilities in OpenVPN for Windows
• Fedora 40 update for openvpn
• Ubuntu update for openvpn
• openEuler update for openvpn
• SUSE update for openvpn
• SUSE update for openvpn
• Multiple vulnerabilities in Siemens SINEMA Remote Connect Client
• Multiple vulnerabilities in Siemens SINEMA Remote Connect Server