Alerts This Week
Warning Icon 1 483
Alerts This Week
Warning Icon 1 483

Ubuntu 23.10: USN-6484-1 Critical OpenVPN Denial of Service

ubuntu
Calendar Grey November 16, 2023
Dist Ubuntu Esm H88
Uncover significant flaws in OpenVPN on Ubuntu and identify essential patches for enhancing security measures.
Several security issues were fixed in OpenVPN.

Summary

Several security issues were fixed in OpenVPN.

Software Description:

- openvpn: virtual private network software

Details:

It was discovered that OpenVPN incorrectly handled the --fragment option

in certain configurations. A remote attacker could possibly use this issue

to cause OpenVPN to crash, resulting in a denial of service.

(CVE-2023-46849)

It was discovered that OpenVPN incorrectly handled certain memory

operations. A remote attacker could use this issue to cause OpenVPN to

crash, obtain sensitive information, or possibly execute arbitrary code.

(CVE-2023-46850)

Topics%20covered

Topics Covered

security advisory denial of service critical issue remote attack Ubuntu OpenVPN

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   openvpn                         2.6.5-0ubuntu1.1

Ubuntu 23.04:
   openvpn                         2.6.1-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6484-1

CVE-2023-46849, CVE-2023-46850

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6484-1

Topics%20covered

Topics Covered

security advisory denial of service critical issue remote attack Ubuntu OpenVPN

Package Information

https://launchpad.net/ubuntu/+source/openvpn/2.6.5-0ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here