CVE-2023-7235
Fixed in a distro release EPSS <1%CVSS 8.4
The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.
Products: OpenVPN
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | openvpn | 2.6.9-r0 |
| Chainguard | openvpn-auth-pam | 2.6.9-r0 |
| Chainguard | openvpn-dev | 2.6.9-r0 |
| Chainguard | openvpn-doc | 2.6.9-r0 |
| Chainguard | openvpn-openrc | 2.6.9-r0 |
| Chainguard | openvpn-supervisor | 2.6.9-r0 |
| Wolfi | openvpn | 2.6.9-r0 |
| Wolfi | openvpn-auth-pam | 2.6.9-r0 |
| Wolfi | openvpn-dev | 2.6.9-r0 |
| Wolfi | openvpn-doc | 2.6.9-r0 |
| Wolfi | openvpn-openrc | 2.6.9-r0 |
| Wolfi | openvpn-supervisor | 2.6.9-r0 |