[CLSA-2026:1793105514] Fix CVE(s): CVE-2024-5594, CVE-2026-84790

Type:

security

Severity:

Moderate

Release date:

2026-10-27 12:52:06 UTC

Description:

   * SECURITY UPDATE: Peer impersonation via a certificate subject field
     containing an embedded NUL byte
     - debian/patches/CVE-2026-84790.patch: reject certificate subjects
       with embedded NUL bytes in x509_get_subject() and the field
       extraction helpers in src/openvpn/ssl_verify_openssl.c and
       src/openvpn/ssl_verify_mbedtls.c
     - CVE-2026-84790
   * SECURITY UPDATE: Unsanitized control channel messages could inject
     arbitrary data into client logs
     - debian/patches/CVE-2024-5594.patch: split control channel messages
       on NUL bytes and drop any command containing non-printable
       characters in src/openvpn/forward.c, src/openvpn/buffer.c,
       src/openvpn/buffer.h
     - CVE-2024-5594

CVEs fixed:

Updated packages:

openvpn_2.4.7-1+deb10u1+tuxcare.els4_amd64.deb
sha:65d421c5e622e7ba5d4f98c4b6d69a2f88c2fff0
openvpn_2.4.7-1+deb10u1+tuxcare.els4_arm64.deb
sha:bb7a513ef376f20855d098a11ff59ce9dd289af5
openvpn_2.4.7-1+deb10u1+tuxcare.els4_armel.deb
sha:f4dcc4d4be4dcc1e98396009c7d29215a1978d0e

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.