OpenVPN 2.6.11 Critical Update: Fixing CVE-2024-5594 and CVE-2024-28882
Summary
OpenVPN is a robust and highly flexible tunneling application that uses all
of the encryption, authentication, and certification features of the
OpenSSL library to securely tunnel IP networks over a single UDP or TCP
port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library
for compression.
Update Information:
Update to upstream OpenVPN 2.6.11 CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them CVE-2024-28882: only call schedule_exit() once (on a given peer)
Change Log
* Fri Jun 21 2024 Frank Lichtenheld
References
[ 1 ] Bug #2270512 - openvpn-2.6.11 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2270512
Update Instructions
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-b611e122fb' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label