CVE catalog

CVE-2024-28820

openvpn-auth-ldap: CVE-2024-28820

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

Buffer overflow in the extract_openvpn_cr function in openvpn-cr.c in openvpn-auth-ldap (aka the Three Rings Auth-LDAP plugin for OpenVPN) 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this field and cause a buffer overflow.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenvpn-auth-ldapsid2.0.4-5fixed
Debianopenvpn-auth-ldapforky2.0.4-5fixed
Debianopenvpn-auth-ldaptrixie2.0.4-4fixed
Debianopenvpn-auth-ldapbookworm2.0.4-3vulnerable
Alpineopenvpn-auth-ldap3.212.0.4-r7fixed
Alpineopenvpn-auth-ldap3.222.0.4-r7fixed
Alpineopenvpn-auth-ldap3.232.0.4-r7fixed
Alpineopenvpn-auth-ldap3.242.0.4-r7fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenvpn-auth-ldapsourcesid2.0.4-4not yet assignedNot reported[1074425]
Debianopenvpn-auth-ldapsourceforky2.0.4-4not yet assignedNot reported[1074425]
Debianopenvpn-auth-ldapsourcetrixie2.0.4-4not yet assignedNot reported[1074425]
Debianopenvpn-auth-ldapsourcebookworm(unfixed)not yet assignedNot reported[1074425]
Alpineopenvpn-auth-ldapapk3.212.0.4-r7Not reportedALPINE-CVE-2024-28820Not reported
Alpineopenvpn-auth-ldapapk3.222.0.4-r7Not reportedALPINE-CVE-2024-28820Not reported
Alpineopenvpn-auth-ldapapk3.232.0.4-r7Not reportedALPINE-CVE-2024-28820Not reported
Alpineopenvpn-auth-ldapapk3.242.0.4-r7Not reportedALPINE-CVE-2024-28820Not reported

[Debian bug #1074425]

Notes

[bookworm] openvpn-auth-ldap: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [openvpn-auth-ldap]Affected
    Details (2)

    • 2.0.4-3 · amd64 · bookworm

      Affected

      dsa · openvpn-auth-ldap · debian · bookworm; dsa · openvpn-auth-ldap · debian · 12

    • 2.0.4-3 · arm64 · bookworm

      Affected

      dsa · openvpn-auth-ldap · debian · bookworm; dsa · openvpn-auth-ldap · debian · 12

[Debian 13 (Trixie)]

  • [openvpn-auth-ldap]Fixed

    Source package: [openvpn-auth-ldap]

    Details (2)

    • 2.0.4-4+b1 · amd64 · trixie

      Fixed · Fixed: 2.0.4-4

      dsa · openvpn-auth-ldap · debian · 13

    • 2.0.4-4+b1 · arm64 · trixie

      Fixed · Fixed: 2.0.4-4

      dsa · openvpn-auth-ldap · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]