git: ebd38b03a85c - main - security/vuxml: add openvpn-devel < 2.7beta2 vuln
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 25 Sep 2025 23:35:22 UTC
The branch main has been updated by mandree:
URL: https://cgit.FreeBSD.org/ports/commit/?id=ebd38b03a85ce7cf3a48324fc94c162b6258eca5
commit ebd38b03a85ce7cf3a48324fc94c162b6258eca5
Author: Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2025-09-25 23:32:05 +0000
Commit: Matthias Andree <mandree@FreeBSD.org>
CommitDate: 2025-09-25 23:34:48 +0000
security/vuxml: add openvpn-devel < 2.7beta2 vuln
PR: 289838
Security: e5cf9f44-9a64-11f0-8241-93c889bb8de1
Security: CVE-2025-10680
---
security/vuxml/vuln/2025.xml | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 3613b324d543..6e245389c3a4 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,43 @@
+ <vuln vid="e5cf9f44-9a64-11f0-8241-93c889bb8de1">
+ <topic>openvpn-devel -- script injection vulnerability from trusted but malicious server</topic>
+ <affects>
+ <package>
+ <name>openvpn-devel</name>
+ <range><ge>g20250629,1</ge><lt>g20250925,1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Gert Doering reports:</p>
+ <blockquote cite="https://github.com/OpenVPN/openvpn/commit/0fb5a00549be6b065f9a4d61940ee06786d9fa61">
+ <p>Notable changes beta1 ->
+ beta2 are: [...] add proper input sanitation to DNS strings to
+ prevent an attack coming from a trusted-but-malicous OpenVPN server
+ (CVE: 2025-10680, affects unixoid systems with --dns-updown scripts
+ and windows using the built-in powershell call)
+ </p>
+ </blockquote>
+ <p>Lev Stipakov writes:</p>
+ <blockquote cite="https://github.com/OpenVPN/openvpn/commit/3a66045b407321c9d1c096227db164df3955ab40">
+ <p> On Linux (and similar platforms), those options are written to a tmp
+ file, which is later sourced by a script running as root. Since
+ options are controlled by the server, it is possible for a malicious
+ server to execute script injection attack [...].</p>
+ </blockquote>
+ <p>The original report is credited to Stanislav Fort <disclosure@aisle.com>.</p>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-10680</cvename>
+ <url>https://github.com/OpenVPN/openvpn/commit/0fb5a00549be6b065f9a4d61940ee06786d9fa61</url>
+ <url>https://github.com/OpenVPN/openvpn/commit/3a66045b407321c9d1c096227db164df3955ab40</url>
+ </references>
+ <dates>
+ <discovery>2025-09-24</discovery>
+ <entry>2025-09-25</entry>
+ </dates>
+ </vuln>
+
<vuln vid="c2253bff-9952-11f0-b6e2-6805ca2fa271">
<topic>dnsdist -- Denial of service via crafted DoH exchange</topic>
<affects>