Connect vulnerabilities
4 known vulnerabilities in Connect from OpenVPN. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
OpenVPN Connect: Improper Neutralization of Special Elements used in an OS Command
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
- 7.5 High severity
OpenVPN Connect: Improper Removal of Sensitive Information Before Storage or Transfer
OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
- 7.8 High severity
OpenVPN Connect: Improper Neutralization of Directives in Dynamically Evaluated Code
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable
- 7.8 High severity
OpenVPN Connect: Improper Control of Generation of Code
OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable